{
  "commits": {
    "316205@main": {
      "author": "Andy Estes",
      "avatar": "https://www.gravatar.com/avatar/643f10f01b26fd94d03482a2013b2ea0?d=identicon\u0026s=64",
      "cl": "316205@main",
      "clUrl": "https://commits.webkit.org/316205@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318272\nrdar://181058453\n\nUnreviewed build fix.\n\n* Source/WebCore/platform/audio/ios/MediaDeviceRoute.h:\n(WebCore::MediaDeviceRouteClient::playbackErrorDidChange):\n(WebCore::MediaDeviceRouteClient::currentPlaybackPositionDidChange):\n(WebCore::MediaDeviceRouteClient::errorDidChange): Deleted.\n(WebCore::MediaDeviceRouteClient::playbackPositionDidChange): Deleted.\n* Source/WebCore/platform/audio/ios/MediaDeviceRoute.mm:\n(-[WebMediaSourceObserver mediaSource]):\n(-[WebMediaSourceObserver setMediaSource:]):\n(-[WebMediaSourceObserver setPlaybackControl:]):\n(-[WebMediaSourceObserver observeValueForKeyPath:ofObject:change:context:]):\n(-[WebMediaSourceObserver dealloc]):\n(WebCore::MediaDeviceRoute::playbackError const):\n(WebCore::MediaDeviceRoute::currentPlaybackPosition const):\n(WebCore::MediaDeviceRoute::setCurrentPlaybackPosition):\n(-[WebPlaybackControlObserver initWithRoute:]): Deleted.\n(-[WebPlaybackControlObserver playbackControl]): Deleted.\n(-[WebPlaybackControlObserver setPlaybackControl:]): Deleted.\n(-[WebPlaybackControlObserver observeValueForKeyPath:ofObject:change:context:]): Deleted.\n(-[WebPlaybackControlObserver dealloc]): Deleted.\n(WebCore::MediaDeviceRoute::setPlaybackPosition): Deleted.\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.cpp:\n(WebCore::MediaPlayerPrivateWirelessPlayback::seekToTarget):\n(WebCore::MediaPlayerPrivateWirelessPlayback::playbackErrorDidChange):\n(WebCore::MediaPlayerPrivateWirelessPlayback::currentPlaybackPositionDidChange):\n(WebCore::MediaPlayerPrivateWirelessPlayback::ensureTimebase):\n(WebCore::MediaPlayerPrivateWirelessPlayback::errorDidChange): Deleted.\n(WebCore::MediaPlayerPrivateWirelessPlayback::playbackPositionDidChange): Deleted.\n* Source/WebCore/platform/graphics/MediaPlayerPrivateWirelessPlayback.h:\n\nCanonical link: https://commits.webkit.org/316205@main",
      "email": "aestes@apple.com",
      "hash": "3b938d7c56e7c4a20182231141f2acb96b626144",
      "subject": "[iOS] 316168@main broke the build"
    },
    "316206@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316206@main",
      "clUrl": "https://commits.webkit.org/316206@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=316822 rdar://179271998\n\nReviewed by Alan Baradlay and Dan Glastonbury.\n\nGive every RenderElement bitfield a default member initializer so defaults live\nwith the declarations, and drop the redundant initializers from the constructor.\n\nKeep all single-bit flags as `unsigned` (not `bool`) so the bitfields share one\nallocation unit, and move m_lastChild up next to m_firstChild so the two packed\npointers are adjacent and all the flags form a single contiguous run. Layout is\nunchanged, as the SameSizeAsRenderElement static_assert confirms.\n\nNo behavior change.\n\n* Source/WebCore/rendering/RenderElement.cpp:\n(WebCore::RenderElement::RenderElement): Drop redundant member initializers.\n* Source/WebCore/rendering/RenderElement.h: Consolidate bitfields, add default\nmember initializers, move m_lastChild adjacent to m_firstChild.\n\nCanonical link: https://commits.webkit.org/316206@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "7d811938adae07a25b84d2854ddb30a3a7ba10ce",
      "subject": "[RenderElement] Consolidate bitfields and move initializers to the header"
    },
    "316207@main": {
      "author": "Marta Darbinyan",
      "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64",
      "cl": "316207@main",
      "clUrl": "https://commits.webkit.org/316207@main",
      "description": "rdar://179851621\nhttps://bugs.webkit.org/show_bug.cgi?id=318167\n\nReviewed by Ryan Haddad.\n\nMove the post-commit opensource AppleSilicon-O3-Debug-JSC-BuildAndTest queue from Sequoia to Tahoe\n\n* Tools/CISupport/build-webkit-org/config.json:\n* Tools/CISupport/build-webkit-org/factories_unittest.py:\n(TestExpectedBuildSteps):\n* Tools/CISupport/build-webkit-org/public_html/dashboard/Scripts/WebKitBuildbot.js:\n(WebKitBuildbot):\n\nCanonical link: https://commits.webkit.org/316207@main",
      "email": "darbinyan@apple.com",
      "hash": "0092c56a379272f37b7340f99f78859a255ccfe7",
      "subject": "[build.webkit.org] Upgrade Apple-Sequoia-AppleSilicon-O3-Debug-JSC-BuildAndTest to Tahoe"
    },
    "316208@main": {
      "author": "Dawn Morningstar",
      "avatar": "https://www.gravatar.com/avatar/9b791f3f02553608941e76bb5eecd471?d=identicon\u0026s=64",
      "cl": "316208@main",
      "clUrl": "https://commits.webkit.org/316208@main",
      "description": "rdar://180065224\n\nReviewed by Jonathan Bedard.\n\nWhen gardening api-tests EWS does not consider the gardened ones as expected and will fail anyway,\nadditionally post-commit does not upload api-test results with expectations considered.\nThis change adjust api-test results to be compatible with both ews and post-commit.\n\n* Tools/CISupport/build-webkit-org/steps.py:\n(RunAPITests):\n(RunAPITests.parseOutputLine):\n* Tools/CISupport/build-webkit-org/steps_unittest.py:\n* Tools/CISupport/ews-build/steps.py:\n(RunAPITests.parseOutputLine):\n* Tools/CISupport/ews-build/steps_unittest.py:\n* Tools/Scripts/webkitpy/api_tests/manager.py:\n(Manager):\n(Manager._expected_results_for_upload):\n(Manager.run):\n* Tools/Scripts/webkitpy/api_tests/manager_unittest.py:\n(test_args_specify_individual_tests):\n(test_expected_results_for_upload_no_expectation):\n(test_expected_results_for_upload_pass):\n(test_expected_results_for_upload_fail):\n(test_expected_results_for_upload_crash):\n(test_expected_results_for_upload_timeout):\n(test_expected_results_for_upload_flaky):\n\nCanonical link: https://commits.webkit.org/316208@main",
      "email": "morningstar@apple.com",
      "hash": "99b8bb251a13c714e639d69aa47b185ee4a54939",
      "subject": "Fix bugs with gardening api-tests"
    },
    "316209@main": {
      "author": "Dan Glastonbury",
      "avatar": "https://www.gravatar.com/avatar/fb7cb28bf9f1bc9fc0c3bbf65566efdc?d=identicon\u0026s=64",
      "cl": "316209@main",
      "clUrl": "https://commits.webkit.org/316209@main",
      "description": "rdar://175674872\n\nReviewed by REVIEWER.\n\nWebXRSession held a raw reference (WebXRSystem\u0026) to its owning WebXRSystem.\nWhen a session's wrapper lives in one realm but the XRSystem belongs to a\ncross-realm iframe (e.g. via XRSystem.prototype.requestSession.call(childXR, ...)),\ndestroying the iframe can collect the child realm's JSDOMWindow / Navigator /\nWebXRSystem while the parent-realm XRSession is still alive. Calling\nsession.end() then dereferences the stale pointer in shutdown() when it calls\nm_xrSystem.sessionEnded(*this).\n\nFix by changing m_xrSystem from a raw reference to a\nWeakPtr\u003cWebXRSystem, WeakPtrImplWithEventTargetData\u003e and guarding the\nsessionEnded() call with a null check.\n\nTest: webxr/xr-session-end-after-cross-realm-system-gc.html\n\n* LayoutTests/webxr/xr-session-end-after-cross-realm-system-gc-expected.txt: Added.\n\nOriginally-landed-as: 305413.844@safari-7624-branch (99867d817a6d). rdar://180436711\n* LayoutTests/webxr/xr-session-end-after-cross-realm-system-gc.html: Added.\n\nCanonical link: https://commits.webkit.org/316209@main",
      "email": "djg@apple.com",
      "hash": "1d46772984f6a2857ade7cd1e2e93d04ab37780f",
      "subject": "[WebXR] Use-after-free when ending an XRSession whose owning WebXRSystem has been garbage collected"
    },
    "316210@main": {
      "author": "Antoine Quint",
      "avatar": "https://www.gravatar.com/avatar/9b3ef1e754f8d994f21ff67c660cbbe6?d=identicon\u0026s=64",
      "cl": "316210@main",
      "clUrl": "https://commits.webkit.org/316210@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314104\nrdar://176274648\n\nReviewed by Anne van Kesteren.\n\nIf the timeline associated with an animation is a plain scroll timeline, but not a view timeline,\nwe must resolve any offset using a view progress timeline range by simply disregarding the keyword.\nThis ensures we have resolved computed offsets in such a case, ensuring we do not crash when attempting\nto create the `AcceleratedEffect` representation for this keyframe effect.\n\nTest: imported/w3c/web-platform-tests/scroll-animations/css/timeline-offset-keyframes-with-scroll-timeline.html\n\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/timeline-offset-keyframes-with-scroll-timeline-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/timeline-offset-keyframes-with-scroll-timeline.html: Added.\n* Source/WebCore/animation/KeyframeEffect.cpp:\n(WebCore::computedOffset):\n(WebCore::computeMissingKeyframeOffsets):\n(WebCore::KeyframeEffect::getKeyframes):\n(WebCore::KeyframeEffect::processKeyframes):\n(WebCore::KeyframeEffect::animationDidTick):\n(WebCore::KeyframeEffect::activeScrollTimeline const):\n(WebCore::KeyframeEffect::updateComputedKeyframeOffsetsIfNeeded):\n(WebCore::KeyframeEffect::activeViewTimeline const): Deleted.\n* Source/WebCore/animation/KeyframeEffect.h:\n\nOriginally-landed-as: 305413.839@safari-7624-branch (4a52a36ff580). rdar://180438807\nCanonical link: https://commits.webkit.org/316210@main",
      "email": "graouts@webkit.org",
      "hash": "699f1cad2c2032231416e73800f9b56d6a447a8a",
      "subject": "[web-animations] accelerated animation with view progress timeline range and a scroll time yields a crash"
    },
    "316211@main": {
      "author": "Marcos Caceres",
      "avatar": "https://www.gravatar.com/avatar/d31c9c6a3b0af558a2945682020e5b90?d=identicon\u0026s=64",
      "cl": "316211@main",
      "clUrl": "https://commits.webkit.org/316211@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317985\nrdar://180768294\n\nReviewed by Sam Sneddon.\n\nRe-imports the web-platform-tests resources directory from upstream. Among\nother updates, this brings in testdriver.js's set_virtual_wallet_behavior,\nwhich the Digital Credentials tests already reference.\n\nThe updated testharness.js and webidl2.js surface pre-existing conformance\ngaps, so some baselines are rebased to their current output: idlharness\nvalidation now rejects the outdated \"async iterable\" IDL syntax still bundled\nunder interfaces/ (bug 318176), and QuotaExceededError is no longer a plain\nDOMException name (bug 295570).\n\nUpstream commit: https://github.com/web-platform-tests/wpt/commit/22ea5cf92e9bcbf6c6506b39b6c3a14e878f4110\n\nCanonical link: https://commits.webkit.org/316211@main",
      "email": "marcosc@apple.com",
      "hash": "b8b79998fe36292b84c8a3d4a00582e844befa4e",
      "subject": "Re-import resources from WPT"
    },
    "316212@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316212@main",
      "clUrl": "https://commits.webkit.org/316212@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318108\n\nReviewed by Brent Fulgham.\n\nThe FTP directory listing feature (FTPDirectoryDocument / FTPDirectoryParser) was\neffectively dead code. It could only be reached when a response carried the\n\"application/x-ftp-directory\" MIME type *and* the hidden, off-by-default\nforceFTPDirectoryListings preference was enabled. WebKit no longer has an FTP\nloader to produce that MIME type organically, so on Apple ports the feature was\nonly ever exercised by a single test that flipped the test-only preference, and it\nwas already disabled (ENABLE_FTPDIR OFF) on the GTK, WPE, WinCairo, and PlayStation\nports.\n\nRemove the parser, the document, the ENABLE_FTPDIR build flag, the two associated\n(now-dead) preferences, and the lone layout test. The separate, live FTPEnabled\n NetworkProcess gate that blocks ftp:// loads is left untouched.\n\nThe WKPreferences C SPI for these preferences is kept as deprecated no-op stubs to\npreserve binary compatibility, matching how other removed preferences are handled.\n\n* LayoutTests/http/tests/misc/ftp-eplf-directory-expected.txt: Removed.\n* LayoutTests/http/tests/misc/ftp-eplf-directory.py: Removed.\n* LayoutTests/platform/gtk/TestExpectations:\n* LayoutTests/platform/win/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WTF/wtf/PlatformEnable.h:\n* Source/WebCore/Sources.txt:\n* Source/WebCore/WebCore.xcodeproj/project.pbxproj:\n* Source/WebCore/dom/DOMImplementation.cpp:\n(WebCore::DOMImplementation::createDocument):\n* Source/WebCore/html/FTPDirectoryDocument.cpp: Removed.\n* Source/WebCore/html/FTPDirectoryDocument.h: Removed.\n* Source/WebCore/loader/DocumentLoader.cpp:\n(WebCore::DocumentLoader::responseReceived):\n* Source/WebCore/loader/FTPDirectoryParser.cpp: Removed.\n* Source/WebCore/loader/FTPDirectoryParser.h: Removed.\n* Source/WebCore/platform/MIMETypeRegistry.cpp:\n(WebCore::MIMETypeRegistry::supportedNonImageMIMETypes):\n* Source/WebCore/platform/network/curl/CurlContext.cpp:\n(WebCore::CurlHandle::enableAllowedProtocols):\n* Source/WebKit/UIProcess/API/C/WKPreferences.cpp:\n(WKPreferencesSetForceFTPDirectoryListings):\n(WKPreferencesGetForceFTPDirectoryListings):\n(WKPreferencesSetFTPDirectoryTemplatePath):\n(WKPreferencesCopyFTPDirectoryTemplatePath):\n* Source/WebKit/UIProcess/API/C/WKPreferencesRefPrivate.h:\n* Source/WebKitLegacy/mac/WebView/WebPreferenceKeysPrivate.h:\n* Source/WebKitLegacy/mac/WebView/WebPreferences.mm:\n(-[WebPreferences _ftpDirectoryTemplatePath]): Deleted.\n(-[WebPreferences _setFTPDirectoryTemplatePath:]): Deleted.\n(-[WebPreferences _forceFTPDirectoryListings]): Deleted.\n(-[WebPreferences _setForceFTPDirectoryListings:]): Deleted.\n* Source/WebKitLegacy/mac/WebView/WebPreferencesPrivate.h:\n* Source/cmake/OptionsGTK.cmake:\n* Source/cmake/OptionsPlayStation.cmake:\n* Source/cmake/OptionsWPE.cmake:\n* Source/cmake/OptionsWin.cmake:\n* Source/cmake/WebKitFeatures.cmake:\n* Tools/Scripts/webkitperl/FeatureList.pm:\n* Tools/lldb/lldb_webkit.py:\n(__lldb_init_module):\n\nCanonical link: https://commits.webkit.org/316212@main",
      "email": "cdumez@apple.com",
      "hash": "82b274a02e255e0c076e27038aa09c55114e8af8",
      "subject": "Remove dead FTP directory listing support (ENABLE_FTPDIR)"
    },
    "316213@main": {
      "author": "Geoffrey Garen",
      "avatar": "https://www.gravatar.com/avatar/9f2ee1a184d00263dc68af055f15b697?d=identicon\u0026s=64",
      "cl": "316213@main",
      "clUrl": "https://commits.webkit.org/316213@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318261\nrdar://180768368\n\nReviewed by Devin Rousso.\n\n* Source/WebCore/inspector/agents/InspectorCanvasAgent.cpp: Suppress RefPtr\nchecking rather than taking a RefPtr. Lifetime is guaranteed by a lock in\nthis case rather than a refcount. And a refcount is not allowed because we\nare operating across threads.\n\nCanonical link: https://commits.webkit.org/316213@main",
      "email": "ggaren@apple.com",
      "hash": "0ead0a09a3c03168e5a77938a25dee0d744acc54",
      "subject": "REGRESSION (315747@main): Crash beneath InspectorCanvasAgent::internalEnable"
    },
    "316214@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "316214@main",
      "clUrl": "https://commits.webkit.org/316214@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318279\nrdar://181070102\n\nReviewed by Yijia Huang.\n\n/Websites/browserbench.org/JetStream3.0 is the right set of JetStream3 files,\nand this directory is containing old files, which is super confusing.\nLet's remove them. Use /Websites/browserbench.org/JetStream3.0's files.\n\n* PerformanceTests/JetStream3/8bitbench/ABOUT.md: Removed.\n* PerformanceTests/JetStream3/8bitbench/assets/program.bin: Removed.\n* PerformanceTests/JetStream3/8bitbench/js3harness.js: Removed.\n* PerformanceTests/JetStream3/8bitbench/lib/fast-text-encoding-1.0.3/text.js: Removed.\n* PerformanceTests/JetStream3/8bitbench/rust/pkg/emu_bench.js: Removed.\n* PerformanceTests/JetStream3/8bitbench/rust/pkg/emu_bench_bg.wasm.debug: Removed.\n* PerformanceTests/JetStream3/8bitbench/rust/pkg/emu_bench_bg.wasm.release: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/README.md: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/airjs-tests.yaml: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/all.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/allocate_stack.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/arg.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/basic_block.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/benchmark.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/code.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/custom.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/frequented_block.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/insertion_set.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/inst.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/liveness.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/make_dist.sh: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/opcode.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/payload-airjs-ACLj8C.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/payload-gbemu-executeIteration.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/payload-imaging-gaussian-blur-gaussianBlur.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/payload-typescript-scanIdentifier.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/reg.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/stack_slot.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/stress-test.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/strip-hash.rb: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/symbols.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/test.html: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/test.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/tmp.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/tmp_base.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Air/util.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Babylon/AUTHORS: Removed.\n* PerformanceTests/JetStream3/ARES-6/Babylon/air-blob.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Babylon/babylon-blob.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Babylon/basic-blob.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Babylon/benchmark.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Babylon/index.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Babylon/inspector-blob.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Basic/ast.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Basic/basic-tests.yaml: Removed.\n* PerformanceTests/JetStream3/ARES-6/Basic/basic.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Basic/benchmark.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Basic/caseless_map.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Basic/lexer.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Basic/number.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Basic/parser.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Basic/random.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Basic/state.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Basic/stress-test.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Basic/test.html: Removed.\n* PerformanceTests/JetStream3/ARES-6/Basic/test.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/Basic/util.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/ml/benchmark.js: Removed.\n* PerformanceTests/JetStream3/ARES-6/ml/index.js: Removed.\n* PerformanceTests/JetStream3/JetStream.css: Removed.\n* PerformanceTests/JetStream3/JetStream3Logo.svg: Removed.\n* PerformanceTests/JetStream3/JetStreamDriver.js: Removed.\n* PerformanceTests/JetStream3/LuaJSFight/hello_world.js: Removed.\n* PerformanceTests/JetStream3/LuaJSFight/list_search.js: Removed.\n* PerformanceTests/JetStream3/LuaJSFight/lists.js: Removed.\n* PerformanceTests/JetStream3/LuaJSFight/richards.js: Removed.\n* PerformanceTests/JetStream3/LuaJSFight/string_lists.js: Removed.\n* PerformanceTests/JetStream3/Octane/box2d.js: Removed.\n* PerformanceTests/JetStream3/Octane/code-first-load.js: Removed.\n* PerformanceTests/JetStream3/Octane/crypto.js: Removed.\n* PerformanceTests/JetStream3/Octane/deltablue.js: Removed.\n* PerformanceTests/JetStream3/Octane/earley-boyer.js: Removed.\n* PerformanceTests/JetStream3/Octane/gbemu-part1.js: Removed.\n* PerformanceTests/JetStream3/Octane/gbemu-part2.js: Removed.\n* PerformanceTests/JetStream3/Octane/mandreel.js: Removed.\n* PerformanceTests/JetStream3/Octane/navier-stokes.js: Removed.\n* PerformanceTests/JetStream3/Octane/pdfjs.js: Removed.\n* PerformanceTests/JetStream3/Octane/raytrace.js: Removed.\n* PerformanceTests/JetStream3/Octane/regexp.js: Removed.\n* PerformanceTests/JetStream3/Octane/richards.js: Removed.\n* PerformanceTests/JetStream3/Octane/run.js: Removed.\n* PerformanceTests/JetStream3/Octane/splay-detail.html: Removed.\n* PerformanceTests/JetStream3/Octane/splay.js: Removed.\n* PerformanceTests/JetStream3/Octane/typescript-compiler.js: Removed.\n* PerformanceTests/JetStream3/Octane/typescript-input.js: Removed.\n* PerformanceTests/JetStream3/Octane/typescript.js: Removed.\n* PerformanceTests/JetStream3/Octane/zlib-data.js: Removed.\n* PerformanceTests/JetStream3/Octane/zlib.js: Removed.\n* PerformanceTests/JetStream3/RAMification.py: Removed.\n* PerformanceTests/JetStream3/RexBench/FlightPlanner/airways.js: Removed.\n* PerformanceTests/JetStream3/RexBench/FlightPlanner/benchmark.js: Removed.\n* PerformanceTests/JetStream3/RexBench/FlightPlanner/convert-nfdc.py: Removed.\n* PerformanceTests/JetStream3/RexBench/FlightPlanner/expectations.js: Removed.\n* PerformanceTests/JetStream3/RexBench/FlightPlanner/flight_planner.js: Removed.\n* PerformanceTests/JetStream3/RexBench/FlightPlanner/use_unicode.js: Removed.\n* PerformanceTests/JetStream3/RexBench/FlightPlanner/waypoints.js: Removed.\n* PerformanceTests/JetStream3/RexBench/Octane2/benchmark.js: Removed.\n* PerformanceTests/JetStream3/RexBench/Octane2/regexp.js: Removed.\n* PerformanceTests/JetStream3/RexBench/OfflineAssembler/InitBytecodes.asm: Removed.\n* PerformanceTests/JetStream3/RexBench/OfflineAssembler/InitBytecodes.js: Removed.\n* PerformanceTests/JetStream3/RexBench/OfflineAssembler/LowLevelInterpreter.asm: Removed.\n* PerformanceTests/JetStream3/RexBench/OfflineAssembler/LowLevelInterpreter.js: Removed.\n* PerformanceTests/JetStream3/RexBench/OfflineAssembler/LowLevelInterpreter32_64.asm: Removed.\n* PerformanceTests/JetStream3/RexBench/OfflineAssembler/LowLevelInterpreter32_64.js: Removed.\n* PerformanceTests/JetStream3/RexBench/OfflineAssembler/LowLevelInterpreter64.asm: Removed.\n* PerformanceTests/JetStream3/RexBench/OfflineAssembler/LowLevelInterpreter64.js: Removed.\n* PerformanceTests/JetStream3/RexBench/OfflineAssembler/ast.js: Removed.\n* PerformanceTests/JetStream3/RexBench/OfflineAssembler/benchmark.js: Removed.\n* PerformanceTests/JetStream3/RexBench/OfflineAssembler/convert_asm_to_js.py: Removed.\n* PerformanceTests/JetStream3/RexBench/OfflineAssembler/expected.js: Removed.\n* PerformanceTests/JetStream3/RexBench/OfflineAssembler/file.js: Removed.\n* PerformanceTests/JetStream3/RexBench/OfflineAssembler/generate_expected.js: Removed.\n* PerformanceTests/JetStream3/RexBench/OfflineAssembler/instructions.js: Removed.\n* PerformanceTests/JetStream3/RexBench/OfflineAssembler/parser.js: Removed.\n* PerformanceTests/JetStream3/RexBench/OfflineAssembler/registers.js: Removed.\n* PerformanceTests/JetStream3/RexBench/SunSpider/benchmark.js: Removed.\n* PerformanceTests/JetStream3/RexBench/SunSpider/regex-dna.js: Removed.\n* PerformanceTests/JetStream3/RexBench/UniPoker/benchmark.js: Removed.\n* PerformanceTests/JetStream3/RexBench/UniPoker/expected.js: Removed.\n* PerformanceTests/JetStream3/RexBench/UniPoker/poker.js: Removed.\n* PerformanceTests/JetStream3/RexBench/about.html: Removed.\n* PerformanceTests/JetStream3/RexBench/benchmark.js: Removed.\n* PerformanceTests/JetStream3/RexBench/cli.js: Removed.\n* PerformanceTests/JetStream3/RexBench/driver.js: Removed.\n* PerformanceTests/JetStream3/RexBench/flightplan_benchmark.js: Removed.\n* PerformanceTests/JetStream3/RexBench/flightplan_unicode_benchmark.js: Removed.\n* PerformanceTests/JetStream3/RexBench/glue.js: Removed.\n* PerformanceTests/JetStream3/RexBench/index.html: Removed.\n* PerformanceTests/JetStream3/RexBench/octane2_benchmark.js: Removed.\n* PerformanceTests/JetStream3/RexBench/offline_assembler_benchmark.js: Removed.\n* PerformanceTests/JetStream3/RexBench/results.js: Removed.\n* PerformanceTests/JetStream3/RexBench/stats.js: Removed.\n* PerformanceTests/JetStream3/RexBench/styles.css: Removed.\n* PerformanceTests/JetStream3/RexBench/sunspider_benchmark.js: Removed.\n* PerformanceTests/JetStream3/RexBench/unipoker_benchmark.js: Removed.\n* PerformanceTests/JetStream3/SeaMonster/ai-astar.js: Removed.\n* PerformanceTests/JetStream3/SeaMonster/gaussian-blur.js: Removed.\n* PerformanceTests/JetStream3/SeaMonster/inspector-json-payload.js: Removed.\n* PerformanceTests/JetStream3/SeaMonster/json-parse-inspector.js: Removed.\n* PerformanceTests/JetStream3/SeaMonster/json-stringify-inspector.js: Removed.\n* PerformanceTests/JetStream3/SeaMonster/sjlc.js: Removed.\n* PerformanceTests/JetStream3/SeaMonster/stanford-crypto-aes.js: Removed.\n* PerformanceTests/JetStream3/SeaMonster/stanford-crypto-pbkdf2.js: Removed.\n* PerformanceTests/JetStream3/SeaMonster/stanford-crypto-sha256.js: Removed.\n* PerformanceTests/JetStream3/SunSpider/3d-cube.js: Removed.\n* PerformanceTests/JetStream3/SunSpider/3d-raytrace.js: Removed.\n* PerformanceTests/JetStream3/SunSpider/base64.js: Removed.\n* PerformanceTests/JetStream3/SunSpider/crypto-aes.js: Removed.\n* PerformanceTests/JetStream3/SunSpider/crypto-md5.js: Removed.\n* PerformanceTests/JetStream3/SunSpider/crypto-sha1.js: Removed.\n* PerformanceTests/JetStream3/SunSpider/date-format-tofte.js: Removed.\n* PerformanceTests/JetStream3/SunSpider/date-format-xparb.js: Removed.\n* PerformanceTests/JetStream3/SunSpider/n-body.js: Removed.\n* PerformanceTests/JetStream3/SunSpider/regex-dna.js: Removed.\n* PerformanceTests/JetStream3/SunSpider/string-unpack-code.js: Removed.\n* PerformanceTests/JetStream3/SunSpider/tagcloud.js: Removed.\n* PerformanceTests/JetStream3/WSL/AddressSpace.js: Removed.\n* PerformanceTests/JetStream3/WSL/All.js: Removed.\n* PerformanceTests/JetStream3/WSL/AnonymousVariable.js: Removed.\n* PerformanceTests/JetStream3/WSL/ArrayRefType.js: Removed.\n* PerformanceTests/JetStream3/WSL/ArrayType.js: Removed.\n* PerformanceTests/JetStream3/WSL/Assignment.js: Removed.\n* PerformanceTests/JetStream3/WSL/AutoWrapper.js: Removed.\n* PerformanceTests/JetStream3/WSL/Block.js: Removed.\n* PerformanceTests/JetStream3/WSL/BoolLiteral.js: Removed.\n* PerformanceTests/JetStream3/WSL/Break.js: Removed.\n* PerformanceTests/JetStream3/WSL/CallExpression.js: Removed.\n* PerformanceTests/JetStream3/WSL/CallFunction.js: Removed.\n* PerformanceTests/JetStream3/WSL/Check.js: Removed.\n* PerformanceTests/JetStream3/WSL/CheckLiteralTypes.js: Removed.\n* PerformanceTests/JetStream3/WSL/CheckLoops.js: Removed.\n* PerformanceTests/JetStream3/WSL/CheckRecursion.js: Removed.\n* PerformanceTests/JetStream3/WSL/CheckRecursiveTypes.js: Removed.\n* PerformanceTests/JetStream3/WSL/CheckReturns.js: Removed.\n* PerformanceTests/JetStream3/WSL/CheckUnreachableCode.js: Removed.\n* PerformanceTests/JetStream3/WSL/CheckWrapped.js: Removed.\n* PerformanceTests/JetStream3/WSL/Checker.js: Removed.\n* PerformanceTests/JetStream3/WSL/CloneProgram.js: Removed.\n* PerformanceTests/JetStream3/WSL/CommaExpression.js: Removed.\n* PerformanceTests/JetStream3/WSL/ConstexprFolder.js: Removed.\n* PerformanceTests/JetStream3/WSL/ConstexprTypeParameter.js: Removed.\n* PerformanceTests/JetStream3/WSL/Continue.js: Removed.\n* PerformanceTests/JetStream3/WSL/ConvertPtrToArrayRefExpression.js: Removed.\n* PerformanceTests/JetStream3/WSL/CreateLiteral.js: Removed.\n* PerformanceTests/JetStream3/WSL/CreateLiteralType.js: Removed.\n* PerformanceTests/JetStream3/WSL/DereferenceExpression.js: Removed.\n* PerformanceTests/JetStream3/WSL/DoWhileLoop.js: Removed.\n* PerformanceTests/JetStream3/WSL/DotExpression.js: Removed.\n* PerformanceTests/JetStream3/WSL/DoubleLiteral.js: Removed.\n* PerformanceTests/JetStream3/WSL/DoubleLiteralType.js: Removed.\n* PerformanceTests/JetStream3/WSL/EArrayRef.js: Removed.\n* PerformanceTests/JetStream3/WSL/EBuffer.js: Removed.\n* PerformanceTests/JetStream3/WSL/EBufferBuilder.js: Removed.\n* PerformanceTests/JetStream3/WSL/EPtr.js: Removed.\n* PerformanceTests/JetStream3/WSL/EnumLiteral.js: Removed.\n* PerformanceTests/JetStream3/WSL/EnumMember.js: Removed.\n* PerformanceTests/JetStream3/WSL/EnumType.js: Removed.\n* PerformanceTests/JetStream3/WSL/EvaluationCommon.js: Removed.\n* PerformanceTests/JetStream3/WSL/Evaluator.js: Removed.\n* PerformanceTests/JetStream3/WSL/Expression.js: Removed.\n* PerformanceTests/JetStream3/WSL/ExpressionFinder.js: Removed.\n* PerformanceTests/JetStream3/WSL/ExternalOrigin.js: Removed.\n* PerformanceTests/JetStream3/WSL/Field.js: Removed.\n* PerformanceTests/JetStream3/WSL/FindHighZombies.js: Removed.\n* PerformanceTests/JetStream3/WSL/FlattenProtocolExtends.js: Removed.\n* PerformanceTests/JetStream3/WSL/FlattenedStructOffsetGatherer.js: Removed.\n* PerformanceTests/JetStream3/WSL/FloatLiteral.js: Removed.\n* PerformanceTests/JetStream3/WSL/FloatLiteralType.js: Removed.\n* PerformanceTests/JetStream3/WSL/FoldConstexprs.js: Removed.\n* PerformanceTests/JetStream3/WSL/ForLoop.js: Removed.\n* PerformanceTests/JetStream3/WSL/Func.js: Removed.\n* PerformanceTests/JetStream3/WSL/FuncDef.js: Removed.\n* PerformanceTests/JetStream3/WSL/FuncInstantiator.js: Removed.\n* PerformanceTests/JetStream3/WSL/FuncParameter.js: Removed.\n* PerformanceTests/JetStream3/WSL/FunctionLikeBlock.js: Removed.\n* PerformanceTests/JetStream3/WSL/HighZombieFinder.js: Removed.\n* PerformanceTests/JetStream3/WSL/IdentityExpression.js: Removed.\n* PerformanceTests/JetStream3/WSL/IfStatement.js: Removed.\n* PerformanceTests/JetStream3/WSL/IndexExpression.js: Removed.\n* PerformanceTests/JetStream3/WSL/InferTypesForCall.js: Removed.\n* PerformanceTests/JetStream3/WSL/Inline.js: Removed.\n* PerformanceTests/JetStream3/WSL/Inliner.js: Removed.\n* PerformanceTests/JetStream3/WSL/InstantiateImmediates.js: Removed.\n* PerformanceTests/JetStream3/WSL/IntLiteral.js: Removed.\n* PerformanceTests/JetStream3/WSL/IntLiteralType.js: Removed.\n* PerformanceTests/JetStream3/WSL/Intrinsics.js: Removed.\n* PerformanceTests/JetStream3/WSL/LateChecker.js: Removed.\n* PerformanceTests/JetStream3/WSL/Lexer.js: Removed.\n* PerformanceTests/JetStream3/WSL/LexerToken.js: Removed.\n* PerformanceTests/JetStream3/WSL/LiteralTypeChecker.js: Removed.\n* PerformanceTests/JetStream3/WSL/LogicalExpression.js: Removed.\n* PerformanceTests/JetStream3/WSL/LogicalNot.js: Removed.\n* PerformanceTests/JetStream3/WSL/LoopChecker.js: Removed.\n* PerformanceTests/JetStream3/WSL/MakeArrayRefExpression.js: Removed.\n* PerformanceTests/JetStream3/WSL/MakePtrExpression.js: Removed.\n* PerformanceTests/JetStream3/WSL/NameContext.js: Removed.\n* PerformanceTests/JetStream3/WSL/NameFinder.js: Removed.\n* PerformanceTests/JetStream3/WSL/NameResolver.js: Removed.\n* PerformanceTests/JetStream3/WSL/NativeFunc.js: Removed.\n* PerformanceTests/JetStream3/WSL/NativeFuncInstance.js: Removed.\n* PerformanceTests/JetStream3/WSL/NativeType.js: Removed.\n* PerformanceTests/JetStream3/WSL/NativeTypeInstance.js: Removed.\n* PerformanceTests/JetStream3/WSL/Node.js: Removed.\n* PerformanceTests/JetStream3/WSL/NormalUsePropertyResolver.js: Removed.\n* PerformanceTests/JetStream3/WSL/NullLiteral.js: Removed.\n* PerformanceTests/JetStream3/WSL/NullType.js: Removed.\n* PerformanceTests/JetStream3/WSL/OriginKind.js: Removed.\n* PerformanceTests/JetStream3/WSL/OverloadResolutionFailure.js: Removed.\n* PerformanceTests/JetStream3/WSL/Parse.js: Removed.\n* PerformanceTests/JetStream3/WSL/Prepare.js: Removed.\n* PerformanceTests/JetStream3/WSL/Program.js: Removed.\n* PerformanceTests/JetStream3/WSL/ProgramWithUnnecessaryThingsRemoved.js: Removed.\n* PerformanceTests/JetStream3/WSL/PropertyAccessExpression.js: Removed.\n* PerformanceTests/JetStream3/WSL/PropertyResolver.js: Removed.\n* PerformanceTests/JetStream3/WSL/Protocol.js: Removed.\n* PerformanceTests/JetStream3/WSL/ProtocolDecl.js: Removed.\n* PerformanceTests/JetStream3/WSL/ProtocolFuncDecl.js: Removed.\n* PerformanceTests/JetStream3/WSL/ProtocolRef.js: Removed.\n* PerformanceTests/JetStream3/WSL/PtrType.js: Removed.\n* PerformanceTests/JetStream3/WSL/ReadModifyWriteExpression.js: Removed.\n* PerformanceTests/JetStream3/WSL/RecursionChecker.js: Removed.\n* PerformanceTests/JetStream3/WSL/RecursiveTypeChecker.js: Removed.\n* PerformanceTests/JetStream3/WSL/ReferenceType.js: Removed.\n* PerformanceTests/JetStream3/WSL/ResolveNames.js: Removed.\n* PerformanceTests/JetStream3/WSL/ResolveOverloadImpl.js: Removed.\n* PerformanceTests/JetStream3/WSL/ResolveProperties.js: Removed.\n* PerformanceTests/JetStream3/WSL/ResolveTypeDefs.js: Removed.\n* PerformanceTests/JetStream3/WSL/Return.js: Removed.\n* PerformanceTests/JetStream3/WSL/ReturnChecker.js: Removed.\n* PerformanceTests/JetStream3/WSL/ReturnException.js: Removed.\n* PerformanceTests/JetStream3/WSL/Rewriter.js: Removed.\n* PerformanceTests/JetStream3/WSL/SPIR-V.js: Removed.\n* PerformanceTests/JetStream3/WSL/SPIRV.html: Removed.\n* PerformanceTests/JetStream3/WSL/SPIRVCodegen.js: Removed.\n* PerformanceTests/JetStream3/WSL/SPIRVTypeAnalyzer.js: Removed.\n* PerformanceTests/JetStream3/WSL/SPIRVVariableAnalyzer.js: Removed.\n* PerformanceTests/JetStream3/WSL/SpecWork/Makefile: Removed.\n* PerformanceTests/JetStream3/WSL/SpecWork/WSL.g4: Removed.\n* PerformanceTests/JetStream3/WSL/SpecWork/WSL.ott: Removed.\n* PerformanceTests/JetStream3/WSL/SpecWork/source/conf.py: Removed.\n* PerformanceTests/JetStream3/WSL/SpecWork/source/index.rst: Removed.\n* PerformanceTests/JetStream3/WSL/StandardLibrary.js: Removed.\n* PerformanceTests/JetStream3/WSL/StatementCloner.js: Removed.\n* PerformanceTests/JetStream3/WSL/StructLayoutBuilder.js: Removed.\n* PerformanceTests/JetStream3/WSL/StructType.js: Removed.\n* PerformanceTests/JetStream3/WSL/Substitution.js: Removed.\n* PerformanceTests/JetStream3/WSL/SwitchCase.js: Removed.\n* PerformanceTests/JetStream3/WSL/SwitchStatement.js: Removed.\n* PerformanceTests/JetStream3/WSL/SynthesizeEnumFunctions.js: Removed.\n* PerformanceTests/JetStream3/WSL/SynthesizeStructAccessors.js: Removed.\n* PerformanceTests/JetStream3/WSL/Test.html: Removed.\n* PerformanceTests/JetStream3/WSL/Test.js: Removed.\n* PerformanceTests/JetStream3/WSL/TrapStatement.js: Removed.\n* PerformanceTests/JetStream3/WSL/Type.js: Removed.\n* PerformanceTests/JetStream3/WSL/TypeDef.js: Removed.\n* PerformanceTests/JetStream3/WSL/TypeDefResolver.js: Removed.\n* PerformanceTests/JetStream3/WSL/TypeOrVariableRef.js: Removed.\n* PerformanceTests/JetStream3/WSL/TypeParameterRewriter.js: Removed.\n* PerformanceTests/JetStream3/WSL/TypeRef.js: Removed.\n* PerformanceTests/JetStream3/WSL/TypeVariable.js: Removed.\n* PerformanceTests/JetStream3/WSL/TypeVariableTracker.js: Removed.\n* PerformanceTests/JetStream3/WSL/TypedValue.js: Removed.\n* PerformanceTests/JetStream3/WSL/UintLiteral.js: Removed.\n* PerformanceTests/JetStream3/WSL/UintLiteralType.js: Removed.\n* PerformanceTests/JetStream3/WSL/UnificationContext.js: Removed.\n* PerformanceTests/JetStream3/WSL/UnreachableCodeChecker.js: Removed.\n* PerformanceTests/JetStream3/WSL/Value.js: Removed.\n* PerformanceTests/JetStream3/WSL/VariableDecl.js: Removed.\n* PerformanceTests/JetStream3/WSL/VariableRef.js: Removed.\n* PerformanceTests/JetStream3/WSL/VisitingSet.js: Removed.\n* PerformanceTests/JetStream3/WSL/Visitor.js: Removed.\n* PerformanceTests/JetStream3/WSL/WSL.md: Removed.\n* PerformanceTests/JetStream3/WSL/WSyntaxError.js: Removed.\n* PerformanceTests/JetStream3/WSL/WTrapError.js: Removed.\n* PerformanceTests/JetStream3/WSL/WTypeError.js: Removed.\n* PerformanceTests/JetStream3/WSL/WhileLoop.js: Removed.\n* PerformanceTests/JetStream3/WSL/WrapChecker.js: Removed.\n* PerformanceTests/JetStream3/WSL/index.html: Removed.\n* PerformanceTests/JetStream3/WSL/spirv.core.grammar.json: Removed.\n* PerformanceTests/JetStream3/WSL/wsl-tests.yaml: Removed.\n* PerformanceTests/JetStream3/__init__.py: Removed.\n* PerformanceTests/JetStream3/bigint/bigdenary-benchmark.js: Removed.\n* PerformanceTests/JetStream3/bigint/bigdenary-bundle.js: Removed.\n* PerformanceTests/JetStream3/bigint/noble-benchmark.js: Removed.\n* PerformanceTests/JetStream3/bigint/noble-bls12-381-bundle.js: Removed.\n* PerformanceTests/JetStream3/bigint/noble-ed25519-bundle.js: Removed.\n* PerformanceTests/JetStream3/bigint/noble-secp256k1-bundle.js: Removed.\n* PerformanceTests/JetStream3/bigint/paillier-benchmark.js: Removed.\n* PerformanceTests/JetStream3/bigint/paillier-bundle.js: Removed.\n* PerformanceTests/JetStream3/bigint/web-crypto-sham.js: Removed.\n* PerformanceTests/JetStream3/cdjs/benchmark.js: Removed.\n* PerformanceTests/JetStream3/cdjs/call_sign.js: Removed.\n* PerformanceTests/JetStream3/cdjs/collision.js: Removed.\n* PerformanceTests/JetStream3/cdjs/collision_detector.js: Removed.\n* PerformanceTests/JetStream3/cdjs/constants.js: Removed.\n* PerformanceTests/JetStream3/cdjs/motion.js: Removed.\n* PerformanceTests/JetStream3/cdjs/red_black_tree.js: Removed.\n* PerformanceTests/JetStream3/cdjs/reduce_collision_set.js: Removed.\n* PerformanceTests/JetStream3/cdjs/simulator.js: Removed.\n* PerformanceTests/JetStream3/cdjs/util.js: Removed.\n* PerformanceTests/JetStream3/cdjs/vector_2d.js: Removed.\n* PerformanceTests/JetStream3/cdjs/vector_3d.js: Removed.\n* PerformanceTests/JetStream3/class-fields/raytrace-private-class-fields.js: Removed.\n* PerformanceTests/JetStream3/class-fields/raytrace-public-class-fields.js: Removed.\n* PerformanceTests/JetStream3/cli.js: Removed.\n* PerformanceTests/JetStream3/clouds.svg: Removed.\n* PerformanceTests/JetStream3/code-load/code-first-load.js: Removed.\n* PerformanceTests/JetStream3/code-load/code-multi-load.js: Removed.\n* PerformanceTests/JetStream3/code-load/inspector-payload-minified.js: Removed.\n* PerformanceTests/JetStream3/code-load/inspector-payload.js: Removed.\n* PerformanceTests/JetStream3/generators/async-file-system.js: Removed.\n* PerformanceTests/JetStream3/generators/js-tokens.js: Removed.\n* PerformanceTests/JetStream3/generators/lazy-collections.js: Removed.\n* PerformanceTests/JetStream3/generators/sync-file-system.js: Removed.\n* PerformanceTests/JetStream3/in-depth.html: Removed.\n* PerformanceTests/JetStream3/index.html: Removed.\n* PerformanceTests/JetStream3/jetstreams.svg: Removed.\n* PerformanceTests/JetStream3/proxy/common.js: Removed.\n* PerformanceTests/JetStream3/proxy/mobx-benchmark.js: Removed.\n* PerformanceTests/JetStream3/proxy/mobx-bundle.js: Removed.\n* PerformanceTests/JetStream3/proxy/vue-benchmark.js: Removed.\n* PerformanceTests/JetStream3/proxy/vue-bundle.js: Removed.\n* PerformanceTests/JetStream3/simple/doxbee-async.js: Removed.\n* PerformanceTests/JetStream3/simple/doxbee-promise.js: Removed.\n* PerformanceTests/JetStream3/simple/float-mm.c: Removed.\n* PerformanceTests/JetStream3/simple/float-mm.c.js: Removed.\n* PerformanceTests/JetStream3/simple/hash-map.js: Removed.\n* PerformanceTests/JetStream3/wasm-cli.js: Removed.\n* PerformanceTests/JetStream3/wasm/HashSet.cpp: Removed.\n* PerformanceTests/JetStream3/wasm/HashSet.js: Removed.\n* PerformanceTests/JetStream3/wasm/HashSet.wasm: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/build.sh: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/config.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/gpc.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/gpc_code_gen_util.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/gpc_instruction.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/gpc_instruction_dispatch.gen: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/gpc_instruction_size.gen: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/gpc_instruction_stack_effects.gen: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/gpc_instruction_static_size.gen: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/gpc_instruction_to_string.gen: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/gpc_int_common.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/gpc_intable.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/gpc_internal.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/gpc_interpreter.gen: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/gpc_program.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/gpc_proto.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/gpc_stack_height.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/gpc_threaded.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/gpc_worklist.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_adaptive_reader.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_asprintf.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_atomics.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_buf_reader.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_buf_writer.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_buffer.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_build_defines.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_config.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_config_stub.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_copier.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_define_helpers.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_define_helpers.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_destructor.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_error.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_format.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_fsdb.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_fsdb_protocol.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_fsdb_protocol.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_generator.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_gpc_code_gen.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_indent.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_internal.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_internal_config.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_internal_config_stub.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_inttypes.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_io.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_io_utils.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_ir.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_ir.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_ir_different.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_ir_different.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_ir_speed.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_limits.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_named_type.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_native.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_parser.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_primitive.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_ra_type_man.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_reflect.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_region.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_serial_in_man.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_serial_out_man.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_serial_protocol.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_sha1.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_sha1.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_sha1_writer.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_sort.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_st.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_st.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_st_typetable.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_stream_file_input.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_stream_file_output.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_type.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_type_in_map.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_type_out_map.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_type_table.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_types.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_util.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_version.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_zip_abstract.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_zip_abstract.h: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_zip_attr.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_zip_reader.c: Removed.\n* PerformanceTests/JetStream3/wasm/TSF/tsf_zip_writer.c: Removed.\n* PerformanceTests/JetStream3/wasm/argon2-benchmark.js: Removed.\n* PerformanceTests/JetStream3/wasm/argon2-bundle.js: Removed.\n* PerformanceTests/JetStream3/wasm/argon2-simd.wasm: Removed.\n* PerformanceTests/JetStream3/wasm/argon2.js: Removed.\n* PerformanceTests/JetStream3/wasm/argon2.wasm: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/CMakeLists.txt: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/README.md: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/argon2/include/argon2.h: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/argon2/src/argon2.c: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/argon2/src/bench.c: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/argon2/src/blake2/blake2-impl.h: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/argon2/src/blake2/blake2.h: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/argon2/src/blake2/blake2b.c: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/argon2/src/blake2/blamka-round-opt.h: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/argon2/src/blake2/blamka-round-ref.h: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/argon2/src/core.c: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/argon2/src/core.h: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/argon2/src/encoding.c: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/argon2/src/encoding.h: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/argon2/src/genkat.c: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/argon2/src/genkat.h: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/argon2/src/opt.c: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/argon2/src/ref.c: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/argon2/src/run.c: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/argon2/src/test.c: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/argon2/src/thread.c: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/argon2/src/thread.h: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/build-wasm.sh: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/build.sh: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/clean-cmake.sh: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/emcc_version.txt: Removed.\n* PerformanceTests/JetStream3/wasm/argon2/src/argon2_library.c: Removed.\n* PerformanceTests/JetStream3/wasm/gcc-loops.cpp: Removed.\n* PerformanceTests/JetStream3/wasm/gcc-loops.js: Removed.\n* PerformanceTests/JetStream3/wasm/gcc-loops.wasm: Removed.\n* PerformanceTests/JetStream3/wasm/quicksort.c: Removed.\n* PerformanceTests/JetStream3/wasm/quicksort.js: Removed.\n* PerformanceTests/JetStream3/wasm/quicksort.wasm: Removed.\n* PerformanceTests/JetStream3/wasm/richards.c: Removed.\n* PerformanceTests/JetStream3/wasm/richards.js: Removed.\n* PerformanceTests/JetStream3/wasm/richards.wasm: Removed.\n* PerformanceTests/JetStream3/wasm/tfjs-backend-wasm-simd.wasm: Removed.\n* PerformanceTests/JetStream3/wasm/tfjs-backend-wasm.wasm: Removed.\n* PerformanceTests/JetStream3/wasm/tfjs-benchmark.js: Removed.\n* PerformanceTests/JetStream3/wasm/tfjs-bundle.js: Removed.\n* PerformanceTests/JetStream3/wasm/tfjs-model-coco-ssd.js: Removed.\n* PerformanceTests/JetStream3/wasm/tfjs-model-helpers.js: Removed.\n* PerformanceTests/JetStream3/wasm/tfjs-model-mobilenet-v1.js: Removed.\n* PerformanceTests/JetStream3/wasm/tfjs-model-mobilenet-v3.js: Removed.\n* PerformanceTests/JetStream3/wasm/tfjs-model-use-vocab.js: Removed.\n* PerformanceTests/JetStream3/wasm/tfjs-model-use.js: Removed.\n* PerformanceTests/JetStream3/wasm/tfjs.js: Removed.\n* PerformanceTests/JetStream3/wasm/tsf.js: Removed.\n* PerformanceTests/JetStream3/wasm/tsf.wasm: Removed.\n* PerformanceTests/JetStream3/watch-cli.js: Removed.\n* PerformanceTests/JetStream3/web-tooling-benchmark/LICENSE: Removed.\n* PerformanceTests/JetStream3/web-tooling-benchmark/acorn.js: Removed.\n* PerformanceTests/JetStream3/web-tooling-benchmark/babylon.js: Removed.\n* PerformanceTests/JetStream3/web-tooling-benchmark/browser.js: Removed.\n* PerformanceTests/JetStream3/web-tooling-benchmark/chai.js: Removed.\n* PerformanceTests/JetStream3/web-tooling-benchmark/cli.js: Removed.\n* PerformanceTests/JetStream3/web-tooling-benchmark/coffeescript.js: Removed.\n* PerformanceTests/JetStream3/web-tooling-benchmark/espree.js: Removed.\n* PerformanceTests/JetStream3/web-tooling-benchmark/jshint.js: Removed.\n* PerformanceTests/JetStream3/web-tooling-benchmark/lebab.js: Removed.\n* PerformanceTests/JetStream3/web-tooling-benchmark/prepack.js: Removed.\n* PerformanceTests/JetStream3/web-tooling-benchmark/uglify-js.js: Removed.\n* PerformanceTests/JetStream3/worker/async-task.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/3d-cube.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/3d-morph.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/3d-raytrace.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/access-binary-trees.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/access-fannkuch.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/access-nbody.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/access-nsieve.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/bitops-3bit-bits-in-byte.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/bitops-bits-in-byte.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/bitops-bitwise-and.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/bitops-nsieve-bits.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/controlflow-recursive.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/crypto-aes.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/crypto-md5.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/crypto-sha1.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/date-format-tofte.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/date-format-xparb.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/math-cordic.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/math-partial-sums.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/math-spectral-norm.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/regexp-dna.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/string-base64.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/string-fasta.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/string-tagcloud.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/string-unpack-code.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb-subtests/string-validate-input.js: Removed.\n* PerformanceTests/JetStream3/worker/bomb.js: Removed.\n* PerformanceTests/JetStream3/worker/segmentation.js: Removed.\n\nCanonical link: https://commits.webkit.org/316214@main",
      "email": "ysuzuki@apple.com",
      "hash": "5a731a3e0e3de18810250e753126a158fc367418",
      "subject": "Remove old JetStream3 files"
    },
    "316215@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316215@main",
      "clUrl": "https://commits.webkit.org/316215@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315350\nrdar://177401683\n\nReviewed by Wenson Hsieh.\n\nisDisallowedTypeForReadBuffer compared the IPC-supplied pasteboard type against\nUIImagePboardType using -isEqualToString:, which is case-sensitive, while\nUIPasteboard / UTType / PBCoercionRegistry resolve type identifiers\ncase-insensitively. A compromised WebContent process could therefore send a\ncase-variant such as \"Com.Apple.UIKit.Image\" or \"Com.Apple.UIKit.AttributedString\"\nto WebPasteboardProxy::ReadBufferFromPasteboard and have UIPasteboard coerce\nattacker-controlled bytes through NSKeyedUnarchiver / ImageIO inside the UI\nprocess, re-opening the parser surface that 260681@main intended to close.\nPlatformPasteboard::readString (reached by ReadStringFromPasteboard,\nGetPasteboardStringForType, GetPasteboardStringsForType, and\nContainsStringSafeForDOMToReadForType) called -valuesForPasteboardType: /\n-dataForPasteboardType: with the IPC-supplied type and no gate at all.\n\nReplace the case-sensitive equality check with a case-insensitive prefix match\nagainst \"com.apple.uikit.\" so that every UIKit private object type (image,\nattributedstring, color) is rejected regardless of case, and apply the same\ngate to readString. WebKit never reads these types as raw NSData via the\npasteboard strategy; it uses dedicated typed accessors instead.\n\nTest: ipc/pasteboard-read-disallowed-uikit-type.html\n\n* LayoutTests/ipc/pasteboard-read-disallowed-uikit-type-expected.txt: Added.\n* LayoutTests/ipc/pasteboard-read-disallowed-uikit-type.html: Added.\n* Source/WebCore/platform/ios/PlatformPasteboardIOS.mm:\n(WebCore::isDisallowedReadType):\n(WebCore::PlatformPasteboard::readBuffer const):\n(WebCore::PlatformPasteboard::readString const):\n(WebCore::isDisallowedTypeForReadBuffer): Deleted.\n\nOriginally-landed-as: 305413.956@safari-7624-branch (5d1f95d6b4aa). rdar://180438330\nCanonical link: https://commits.webkit.org/316215@main",
      "email": "cdumez@apple.com",
      "hash": "1dc6a86a7e770aa1b6b20e5268d4f507ca19926b",
      "subject": "[WebKit Process Model | All] isDisallowedTypeForReadBuffer uses case-sensitive isEqualToString: while UIPasteboard resolves type identifiers case-insensitively; readString has no gate"
    },
    "316216@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316216@main",
      "clUrl": "https://commits.webkit.org/316216@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312734\nrdar://174674094\n\nReviewed by Ryosuke Niwa.\n\nBlobData was ThreadSafeRefCounted but contained data members that were\nnot safe to destroy on other threads like a String and a\n`RefPtr\u003cBlobDataFileReference\u003e` (BlobDataFileReference only subclasses\nRefCounted). For thread safety, both BlobData and BlobDataFileReference\nnow subclass `ThreadSafeRefCounted\u003cT, WTF::DestructionThread::Main\u003e` so\nthat not only their ref-counting is atomic but also to guarantee that\nthey get destroyed on the main thread (since they are always constructed\non the main thread). This is important given that they have String\ndata members.\n\nAlso, as further hardening recommended by the AI, update MappedFileData\nto be able to distinguish empty data and invalid data.\n\n* Source/WTF/wtf/MappedFileData.h:\n(WTF::FileSystemImpl::MappedFileData::emptyFile):\n(WTF::FileSystemImpl::MappedFileData::operator bool const):\n(WTF::FileSystemImpl::MappedFileData::leakHandle):\n(WTF::FileSystemImpl::MappedFileData::fileMapping const):\n* Source/WTF/wtf/posix/FileHandlePOSIX.cpp:\n(WTF::FileSystemImpl::FileHandle::map):\n* Source/WTF/wtf/posix/MappedFileDataPOSIX.cpp:\n(WTF::FileSystemImpl::MappedFileData::MappedFileData):\n* Source/WTF/wtf/win/FileHandleWin.cpp:\n(WTF::FileSystemImpl::FileHandle::map):\n* Source/WTF/wtf/win/MappedFileDataWin.cpp:\n(WTF::FileSystemImpl::MappedFileData::MappedFileData):\n* Source/WebCore/platform/network/BlobData.cpp:\n(WebCore::BlobData::BlobData):\n* Source/WebCore/platform/network/BlobData.h:\n* Source/WebCore/platform/network/BlobDataFileReference.cpp:\n(WebCore::BlobDataFileReference::BlobDataFileReference):\n* Source/WebCore/platform/network/BlobDataFileReference.h:\n\nOriginally-landed-as: 305413.709@safari-7624-branch (5b1739a247ed). rdar://180438123\nCanonical link: https://commits.webkit.org/316216@main",
      "email": "cdumez@apple.com",
      "hash": "d643555ed4f5ce21f793190d467008b2e0754ccf",
      "subject": "Cross-Thread Destruction of BlobData Races Non-Thread-Safe RefCounted\u003cBlobDataFileReference\u003e Leads to UAF"
    },
    "316217@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316217@main",
      "clUrl": "https://commits.webkit.org/316217@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313612\nrdar://175673312\n\nReviewed by Ryosuke Niwa and Rupin Mittal.\n\nprotect the security origin before passing it to scheduleLocationChange().\nThe Safer CPP bot was reporting this already but we had not ported\nDocument.cpp yet.\n\n* LayoutTests/http/tests/workers/service/navigate-client-from-service-worker-expected.txt: Added.\n* LayoutTests/http/tests/workers/service/navigate-client-from-service-worker.html: Added.\n* LayoutTests/http/tests/workers/service/resources/navigate-client-from-service-worker-child.html: Added.\n* LayoutTests/http/tests/workers/service/resources/navigate-client-from-service-worker-dest.html: Added.\n* LayoutTests/http/tests/workers/service/resources/navigate-client-from-service-worker-target.html: Added.\n* LayoutTests/http/tests/workers/service/resources/navigate-client-from-service-worker-worker.js: Added.\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::navigateFromServiceWorker):\n\nOriginally-landed-as: 305413.771@safari-7624-branch (b401d77db3cf). rdar://180437578\nCanonical link: https://commits.webkit.org/316217@main",
      "email": "cdumez@apple.com",
      "hash": "ccb3ee3ebe364b5b8df6a7e100ae682496f3c6a7",
      "subject": "Use-after-free on SecurityOrigin in NavigationScheduler::scheduleLocationChange"
    },
    "316218@main": {
      "author": "Yury Semikhatsky",
      "avatar": "https://www.gravatar.com/avatar/d0aee26d9689e84bd1a7f0ed8f262fe1?d=identicon\u0026s=64",
      "cl": "316218@main",
      "clUrl": "https://commits.webkit.org/316218@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318280\n\nReviewed by Carlos Alberto Lopez Perez.\n\nWebKitPointerLockPermissionRequest's public header was GTK-only and\nexposed via PLATFORM(GTK), so it couldn't build on WPE with\nENABLE(POINTER_LOCK) on. Move it to the shared glib API, make it\nport-neutral, wire it into the WPE build, and gate it on\nENABLE(POINTER_LOCK) instead of PLATFORM(GTK). No default change.\n\n* Source/WebKit/PlatformGTK.cmake:\n* Source/WebKit/PlatformWPE.cmake:\n* Source/WebKit/SourcesWPE.txt:\n* Source/WebKit/UIProcess/API/glib/WebKitAutocleanups.h.in:\n* Source/WebKit/UIProcess/API/glib/WebKitPointerLockPermissionRequest.h.in: Renamed from Source/WebKit/UIProcess/API/gtk/WebKitPointerLockPermissionRequest.h.in.\n* Source/WebKit/UIProcess/API/glib/WebKitWebView.cpp:\n* Source/WebKit/UIProcess/API/glib/webkit.h.in:\n\nCanonical link: https://commits.webkit.org/316218@main",
      "email": "yurys@chromium.org",
      "hash": "be1bc4ce94f59c299293b44d338cb38a5a2a7261",
      "subject": "[WPE] Support building with POINTER_LOCK enabled"
    },
    "316219@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316219@main",
      "clUrl": "https://commits.webkit.org/316219@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318188\nrdar://180998446\n\nReviewed by Frédéric Wang Nélar.\n\nThe anonymous union holding m_variantGlyph/m_assembly is keyed by\nm_stretchType, but reset() set m_stretchType back to Unstretched without\nclearing the union. A previously stretched operator kept stale variant/\nassembly data after reset. Re-initialize the union (m_variantGlyph = 0) to\nits constructed state, as the old constructor did.\n\n* Source/WebCore/rendering/mathml/MathOperator.cpp:\n(WebCore::MathOperator::reset):\n\nCanonical link: https://commits.webkit.org/316219@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "78d11dc099ead8749d55b92596e7a23ec1447e6d",
      "subject": "[MathML] MathOperator::reset() does not re-initialize the m_variantGlyph/m_assembly union"
    },
    "316220@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316220@main",
      "clUrl": "https://commits.webkit.org/316220@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=295171\nrdar://155138028\n\nReviewed by Chris Dumez.\n\nReordered the bitfields so they pack into two 32-bit units (21+5+1, then\n14+16) instead of straddling unit boundaries, bringing the struct down from\n12 bytes to the intended 8. Updated create-html-entity-table to emit the\nmembers in the new order, and added a static_assert to lock in the size.\n\nThanks to Darin for initial idea on how to map these.\n\n* Source/WebCore/html/parser/HTMLEntityTable.h:\n* Source/WebCore/html/parser/create-html-entity-table:\n\nCanonical link: https://commits.webkit.org/316220@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "4b3bf5aaf43d212ba2aa4a91fbb3a36f6effb4c3",
      "subject": "Padding bits defeat intended HTMLEntityTableEntry size optimization"
    },
    "316221@main": {
      "author": "Alex Christensen",
      "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64",
      "cl": "316221@main",
      "clUrl": "https://commits.webkit.org/316221@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318278\nrdar://181068199\n\nUnreviewed.\n\nThis is a speculative fix for the build failures found by EWS in my PR\nhttps://github.com/WebKit/WebKit/pull/68347\nThe build fixes are unrelated, so I'm putting them in their own PR.\n\n* Source/WebKit/UIProcess/XR/xros/WKSpatialGestureRecognizer.h:\n* Source/WebKit/UIProcess/XR/xros/WKSpatialGestureRecognizer.mm:\n\nCanonical link: https://commits.webkit.org/316221@main",
      "email": "achristensen@apple.com",
      "hash": "664932f553a2aa93fe523e4e05067c4ce168bd6d",
      "subject": "Fix visionOS build after removing a file from Cocoa API"
    },
    "316222@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "316222@main",
      "clUrl": "https://commits.webkit.org/316222@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318282\nrdar://problem/181070532\n\nReviewed by David Kilzer and Vitor Roriz.\n\nCode related to the GridItemSizingFunctions live in both\nTrackSizingAlgorithm and GridLayoutUtils. The former provides some\nhelpers to get a specific set of functions depending on the axis the\ncaller wants while the former provides the definiton of the struct.\nWe can improve the organization of the code by just moving both of these\nthings into the same file so that they both live next to each other.\n\nCanonical link: https://commits.webkit.org/316222@main",
      "email": "sammy.gill@apple.com",
      "hash": "e2948d01a4de9706b6f900da7cd9754cec5ea607",
      "subject": "[GFC] Move GridItemSizingFunctions to its own file."
    },
    "316223@main": {
      "author": "Roberto Rodriguez",
      "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64",
      "cl": "316223@main",
      "clUrl": "https://commits.webkit.org/316223@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315161\nrdar://177359720\n\nReviewed by Kimmo Kinnunen.\n\nAll mutators of the WebGL bound-object graph hold objectGraphLock to synchronize with\naddMembersToOpaqueRoots on the GC helper thread, except for initializeContextState and\ninitializeDefaultObjects on the WEBGL_lose_context restore path. That path reassigns\nbinding points for the default WebGLTransformFeedback and WebGLVertexArrayObject, freeing\nthem while the GC marker may still be traversing them.\n\nFix by holding objectGraphLock in initializeNewContext around both calls and add\nWTF_REQUIRES_LOCK annotations to catch this at compile time.\n\nTest: fast/canvas/webgl/context-restore-concurrent-gc-no-crash.html\n\n* LayoutTests/fast/canvas/webgl/context-restore-concurrent-gc-no-crash-expected.txt: Added.\n* LayoutTests/fast/canvas/webgl/context-restore-concurrent-gc-no-crash.html: Added.\n* Source/WebCore/html/canvas/WebGL2RenderingContext.h:\n* Source/WebCore/html/canvas/WebGLRenderingContext.h:\n* Source/WebCore/html/canvas/WebGLRenderingContextBase.cpp:\n(WebCore::WebGLRenderingContextBase::initializeNewContext):\n* Source/WebCore/html/canvas/WebGLRenderingContextBase.h:\n\nOriginally-landed-as: 305413.940@safari-7624-branch (6d64b1760e9a). rdar://180429453\nCanonical link: https://commits.webkit.org/316223@main",
      "email": "roberto_rodriguez2@apple.com",
      "hash": "034f2fbd9b69edba4969f7f336283e8ce3d8e09f",
      "subject": "[WebGL] Missing objectGraphLock on WebGL context restore races with GC"
    },
    "316224@main": {
      "author": "Alex Christensen",
      "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64",
      "cl": "316224@main",
      "clUrl": "https://commits.webkit.org/316224@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318243\nrdar://181049251\n\nReviewed by Richard Robinson.\n\nAPI review realized it was just a wrapper around NSData from an API shape perspective,\nso just use NSData instead.  After the internal change rdar://181046897 this doesn't\nbreak anything.\n\nTests: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/JSBuffer.mm\n       Tools/TestWebKitAPI/Tests/WebKit/WKWebView/UserContentController.mm\n\n* Source/WebKit/Modules/OSX_Private.modulemap:\n* Source/WebKit/Modules/iOS_Private.modulemap:\n* Source/WebKit/PlatformIOS.cmake:\n* Source/WebKit/Shared/API/APIObject.h:\n* Source/WebKit/Shared/API/Cocoa/WebKit.h:\n* Source/WebKit/Shared/Cocoa/APIObject.mm:\n(API::Object::newObject):\n* Source/WebKit/Shared/WebUserContentControllerDataTypes.cpp:\n(WebKit::WebJSBufferData::WebJSBufferData):\n* Source/WebKit/Shared/WebUserContentControllerDataTypes.h:\n* Source/WebKit/Sources.txt:\n* Source/WebKit/SourcesCocoa.txt:\n* Source/WebKit/UIProcess/API/APIJSBuffer.cpp: Removed.\n* Source/WebKit/UIProcess/API/APIJSBuffer.h: Removed.\n* Source/WebKit/UIProcess/API/Cocoa/WKJSScriptingBuffer.h: Removed.\n* Source/WebKit/UIProcess/API/Cocoa/WKJSScriptingBuffer.mm: Removed.\n* Source/WebKit/UIProcess/API/Cocoa/WKJSScriptingBufferInternal.h: Removed.\n* Source/WebKit/UIProcess/API/Cocoa/WKUserContentController.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKUserContentController.mm:\n(-[WKUserContentController addBuffer:name:contentWorld:]):\n(-[WKUserContentController _addBuffer:contentWorld:name:]): Deleted.\n(-[WKUserContentController _removeBufferWithName:contentWorld:]): Deleted.\n* Source/WebKit/UIProcess/API/Cocoa/WKUserContentControllerPrivate.h:\n* Source/WebKit/UIProcess/API/Cocoa/_WKJSBuffer.h: Removed.\n* Source/WebKit/UIProcess/UserContent/WebUserContentControllerProxy.cpp:\n(WebKit::WebUserContentControllerProxy::parametersForProcess const):\n(WebKit::WebUserContentControllerProxy::addJSBuffer):\n* Source/WebKit/UIProcess/UserContent/WebUserContentControllerProxy.h:\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/JSBuffer.mm:\n(TEST(JSBuffer, Data)):\n(TEST(JSBuffer, EvaluateScript)):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/UserContentController.mm:\n(TEST(WKUserContentController, JSBufferInjectsWebKitNamespace)):\n\nCanonical link: https://commits.webkit.org/316224@main",
      "email": "achristensen@apple.com",
      "hash": "1b4724a5fcc7ba6f33111f535f7954e36f90c10d",
      "subject": "Remove WKJSScriptingBuffer"
    },
    "316225@main": {
      "author": "Angelos Oikonomopoulos",
      "avatar": "https://www.gravatar.com/avatar/ee46106043323b10e0bb3c899f9590e5?d=identicon\u0026s=64",
      "cl": "316225@main",
      "clUrl": "https://commits.webkit.org/316225@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318217\n\nUnreviewed gardening.\n\nThe timeout increase wasn't enough, skip them for now.\n\nCanonical link: https://commits.webkit.org/316225@main",
      "email": "angelos@igalia.com",
      "hash": "995f2d1901539fd8dd524301055a051e63f0321b",
      "subject": "[JSC] Skip failing modes for wasm simd tests on linux/arm64"
    },
    "316226@main": {
      "author": "Kiet Ho",
      "avatar": "https://www.gravatar.com/avatar/d9058b37006dce1f55f91b8ccc82f9a3?d=identicon\u0026s=64",
      "cl": "316226@main",
      "clUrl": "https://commits.webkit.org/316226@main",
      "description": "rdar://175679565\n\nReviewed by Elika Etemad.\n\nLocalFrameViewLayoutContext::removeScrollerFromAnchorScrollAdjusters iterates\nthrough m_anchorScrollAdjusters, and unregisters adjusters belonging to the\nscroller by calling unregisterAnchorScrollAdjusterFor. unregisterAnchorScrollAdjusterFor\nin turn removes adjusters also from m_anchorScrollAdjusters, which is being iterated on.\nVectors are not safe to modify when iterating through. Change the loop to save the list\nof adjusters to be removed in a HashSet, then remove the saved adjusters after.\n\nNOTE: this was fixed a while ago, but while waiting for a merge-back, it got fixed in\nupstream in 316000@main. The fixes are equivalent, so this merge-back opts to keep the\nupstreamed fix and adds a test.\n\nTest: imported/w3c/web-platform-tests/css/css-anchor-position/scroll-compensation-crash.html\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-anchor-position/scroll-compensation-crash.html: Added.\n\nOriginally-landed-as: 305413.802@safari-7624-branch (444a849510b9). rdar://180427816\nCanonical link: https://commits.webkit.org/316226@main",
      "email": "kiet.ho@apple.com",
      "hash": "bdc84c14a8e6548918f4a62442cdcef2ac507495",
      "subject": "[css-anchor-position-1] removeScrollerFromAnchorScrollAdjusters mutates array when iterating through it"
    },
    "316227@main": {
      "author": "Anne van Kesteren",
      "avatar": "https://www.gravatar.com/avatar/09bb44ac3625a121017cd98d0a7dc52c?d=identicon\u0026s=64",
      "cl": "316227@main",
      "clUrl": "https://commits.webkit.org/316227@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312348\nrdar://174448452\n\nReviewed by Ryosuke Niwa.\n\nsequence\u003cany\u003e and FrozenArray\u003cany\u003e are fundamentally unsafe as\ncurrently implemented. Fortunately the only place where we use\nsequence\u003cany\u003e can use sequence\u003cDOMString\u003e.\n\nSo adopt sequence\u003cDOMString\u003e there and add static asserts to prevent\nfuture adoption of the unsafe constructs.\n\nOriginally-landed-as: 305413.680@safari-7624-branch (65ba1780134a). rdar://180437855\nCanonical link: https://commits.webkit.org/316227@main",
      "email": "annevk@annevk.nl",
      "hash": "3a88b7cf55602cbb76f98e54838363a2d8eee504",
      "subject": "Use-after-free in XRSessionInit dictionary conversion via sequence\u003cany\u003e"
    },
    "316228@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316228@main",
      "clUrl": "https://commits.webkit.org/316228@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318207\nrdar://181008611\n\nReviewed by Chris Dumez.\n\nm_resourceType (CachedResource::Type, a uint8_t enum) sat between\nm_charset and m_mediaAttribute, both pointer-sized String members,\nforcing 7 bytes of padding into its own 8-byte slot. The class already\nhas a cluster of sub-word members at the tail (m_scriptIsAsync,\nm_scriptType, m_referrerPolicy, m_fetchPriority) sharing a single\n8-byte slot with room to spare.\n\nMove m_resourceType down into that cluster so all five small members\npack into one slot, shrinking PreloadRequest by 8 bytes. The\nconstructor initializer list is reordered to match the new member\ndeclaration order. No behavior change.\n\n* Source/WebCore/html/parser/HTMLResourcePreloader.h:\n(WebCore::PreloadRequest::PreloadRequest):\n\nCanonical link: https://commits.webkit.org/316228@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "8a023d3464fa200520aaf8d97eb5ffc0476ae7c9",
      "subject": "Reduce PreloadRequest size by 8 bytes via field reordering"
    },
    "316229@main": {
      "author": "Nikolas Zimmermann",
      "avatar": "https://www.gravatar.com/avatar/83cbd636495835720e369cd589e3ca5e?d=identicon\u0026s=64",
      "cl": "316229@main",
      "clUrl": "https://commits.webkit.org/316229@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=308565\n\nReviewed by Simon Fraser.\n\nSince SVG renderers no longer unconditionally own a RenderLayer, leaf renderers\n(path/image/text) are no longer reached by collectEventRegionForFragments() and\nmust collect their event region through the layered ancestor's DOM-order child\nwalk (paintChildrenInDOMOrderForSVG). That walk only paints non-layer children\nin their precomputed phasesToPaint ({ Foreground, Outline }), never in the\nEventRegion phase, so touch/wheel/pointer regions for non-layer SVG content were\ndropped -- e.g. an ontouchstart handler on a \u003cpath\u003e registered no region. (The\n\u003csvg\u003e root still contributed via RenderSVGRoot::paintObject().)\n\nCollect the event region for non-layer children through the same DOM-order walk.\nFixes regressions on iOS in fast/events/touch/ios/touch-event-regions-layer-tree.\n\n* Source/WebCore/rendering/RenderLayerSVGAdditions.cpp:\n(WebCore::RenderLayer::paintNonLayerChildForFragmentsForSVG): In the EventRegion\nphase, mirror collectEventRegionForFragments(): run even when shouldPaintContent\nis false, and propagate regionContext into the child PaintInfo.\n(WebCore::RenderLayer::paintChildrenInDOMOrderForSVG): When collecting the event\nregion, paint non-layer children in the EventRegion phase.\n\nCanonical link: https://commits.webkit.org/316229@main",
      "email": "nzimmermann@igalia.com",
      "hash": "bfaede7cf21865fae630d3a54e058bf986a8d3a3",
      "subject": "REGRESSION(315610@main): [LBSE] Event regions missing for non-layer SVG children"
    },
    "316231@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316231@main",
      "clUrl": "https://commits.webkit.org/316231@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318199\nrdar://181004373\n\nReviewed by Chris Dumez.\n\nThe RgbaFloat16 case in the switch in ImageDataArray::tryCreate() was\nmissing a break statement. Add the break for consistency with the\nRgbaUnorm8 case.\n\n* Source/WebCore/html/ImageDataArray.cpp:\n(WebCore::ImageDataArray::tryCreate):\n\nCanonical link: https://commits.webkit.org/316231@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "388719d86c5d0db1b6aaf3c57161de3889fc8c01",
      "subject": "Add missing break statement in ImageDataArray::tryCreate switch"
    },
    "316232@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316232@main",
      "clUrl": "https://commits.webkit.org/316232@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318200\nrdar://181004952\n\nReviewed by Chris Dumez.\n\nThe `if (refNode)` guard before `fragment.removeNode(*refNode)` is dead\ncode: refNode is guaranteed non-null at this point because the function\nalready returns early when the fragment is empty\n(`if (fragment.isEmpty() || !fragment.firstChild()) return;`), and the\npreceding line dereferences refNode unconditionally via\n`refNode-\u003enextSibling()`. Drop the guard and call removeNode directly.\n\nNo change in behavior.\n\n* Source/WebCore/editing/ReplaceSelectionCommand.cpp:\n(WebCore::ReplaceSelectionCommand::doApply):\n\nCanonical link: https://commits.webkit.org/316232@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "e1c3e2ea1083c60d52c2de3da7da4a76273cd4f5",
      "subject": "Remove dead null check in ReplaceSelectionCommand::doApply"
    },
    "316233@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316233@main",
      "clUrl": "https://commits.webkit.org/316233@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318208\nrdar://181009514\n\nReviewed by Chris Dumez.\n\nm_implementation (Implementation, a uint8_t enum) was declared as the\nfirst data member, immediately followed by m_file (RefPtr), so it sat\nalone in its own 8-byte slot with 7 bytes of padding. The class already\nhas sub-word members at the tail (m_needsIconRequest and, under\nENABLE(SERVICE_CONTROLS), m_isImageMenuEnabled) that share a slot.\n\nMove m_implementation down next to those bools so the small members pack\ninto a single 8-byte slot, shrinking HTMLAttachmentElement by 8 bytes.\nm_implementation is only ever set via assignment, never in a constructor\ninitializer list, so declaration order is unaffected. No behavior change.\n\nBefore: 288\nAfter: 280\n\n* Source/WebCore/html/HTMLAttachmentElement.h:\n\nCanonical link: https://commits.webkit.org/316233@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "6ab09f9bd2119bb49fb557c41469e56b5037907b",
      "subject": "Reduce HTMLAttachmentElement size by 8 bytes via field reordering"
    },
    "316234@main": {
      "author": "Per Arne Vollan",
      "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64",
      "cl": "316234@main",
      "clUrl": "https://commits.webkit.org/316234@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318233\nrdar://181036355\n\nReviewed by Rupin Mittal and Basuke Suzuki.\n\nThis allows the log message to be forwarded from the WebContent process\nto the UIProcess via IPC without sending the format string, improving\nlog efficiency.\n\n* Source/WebKit/Platform/LogMessages.in:\n* Source/WebKit/Shared/Cocoa/CoreIPCNSURLRequest.mm:\n(WebKit::populateAppProperties):\n\nCanonical link: https://commits.webkit.org/316234@main",
      "email": "pvollan@apple.com",
      "hash": "8c9a60e3d3f64ab1db905ff8044dbc398cfedd0a",
      "subject": "Improve log efficiency in CoreIPCNSURLRequest"
    },
    "316235@main": {
      "author": "Per Arne Vollan",
      "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64",
      "cl": "316235@main",
      "clUrl": "https://commits.webkit.org/316235@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317446\nrdar://180071219\n\nReviewed by Rupin Mittal.\n\nThis allows the log message to be forwarded from the WebContent process\nto the UIProcess via IPC without sending the format string, improving\nlog efficiency.\n\n* Source/WebCore/loader/FrameLoader.cpp:\n(WebCore::FrameLoader::clearProvisionalLoad):\n* Source/WebCore/platform/LogMessages.in:\n\nCanonical link: https://commits.webkit.org/316235@main",
      "email": "pvollan@apple.com",
      "hash": "847d76875aee2e6d7623b1155c36d037c0a7c066",
      "subject": "Improve log efficiency in FrameLoader::clearProvisionalLoad"
    },
    "316236@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316236@main",
      "clUrl": "https://commits.webkit.org/316236@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318119\nrdar://180944892\n\nReviewed by Chris Dumez.\n\nMerge: https://chromium-review.googlesource.com/c/chromium/src/+/1931412\n\nReplacementFragment::removeContentsWithSideEffects() sanitizes fragments\ninserted by paste, drop, and InsertHTML. It strips script elements and\nHTMLStyleElement (along with base/link/meta/title), but it never checked\nfor SVGStyleElement, so an SVG \u003cstyle\u003e element survived sanitization and\nits stylesheet could be applied to the destination document.\n\nOn Cocoa the paste path masks this because incoming markup is run through\nsanitizeMarkup() first, but InsertHTML (execCommand) reaches\nremoveContentsWithSideEffects() directly with no other sanitizer in front\nof it, leaving the loophole web-reachable.\n\nAdd SVGStyleElement to the set of elements removed by\nremoveContentsWithSideEffects().\n\nTest: editing/pasteboard/paste-strips-svg-style-element.html\n\n* LayoutTests/editing/pasteboard/paste-strips-svg-style-element-expected.txt: Added.\n* LayoutTests/editing/pasteboard/paste-strips-svg-style-element.html: Added.\n* Source/WebCore/editing/ReplaceSelectionCommand.cpp:\n(WebCore::ReplacementFragment::removeContentsWithSideEffects):\n\nCanonical link: https://commits.webkit.org/316236@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "a3a6a4976b58db93b275c8062c9ad9295f3a0021",
      "subject": "Strip SVGStyleElement in ReplaceSelectionCommand"
    },
    "316237@main": {
      "author": "Tetsuharu Ohzeki",
      "avatar": "https://www.gravatar.com/avatar/549cbf8e9e2460763d7248f6266be8af?d=identicon\u0026s=64",
      "cl": "316237@main",
      "clUrl": "https://commits.webkit.org/316237@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314063\n\nReviewed by Yusuke Suzuki.\n\nAccording to the spec https://tc39.es/ecma262/2026/#sec-typedarray\nIf the 1st argument of `new TypedArray(value)` is not an Object,\nthe step 9 |ToIndex(firstArgument)| should be executed before the step 10 |AllocateTypedArray|.\n\nThe current DFG/FTL implementation invoke the runtime code as a slow path\nfor the 1st argument is not int32/int52rep (DFG node would be `NewTypedArray(UntypedUse)`).\nThen |ToIndex(firstArgument)| is also delegated to the runtime.\n\nTo simplify this flow, this patch introduce `operationConstructGenericTypedArrayViewWithOneArgumentImpl()`.\n\nThis patch adds new 2 kind of tests:\n\n1. Simple port of test262's test/built-ins/TypedArrayConstructors/ctors/typedarray-arg/throw-type-error-before-custom-proto-access.js.\n2. DFG/FTL delegate |ToIndex(firstArgument)| properly.\n    - Test variants named as typedarray-constructor-jit-compliant-toindex-firstarg-*\n\nTests: JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-biguint64.js\n       JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-bitint64.js\n       JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-float16array.js\n       JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-float32array.js\n       JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-float64array.js\n       JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-int16array.js\n       JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-int32array.js\n       JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-int8array.js\n       JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-uint16array.js\n       JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-uint32array.js\n       JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-uint8array.js\n       JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-uint8clampledarray.js\n       JSTests/stress/typedarray-constructor-toindex-length-before-allocatetypedarray-if-1st-arg-not-object.js\n\n* JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-biguint64.js: Added.\n(shouldThrow):\n* JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-bitint64.js: Added.\n(shouldThrow):\n* JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-float16array.js: Added.\n(shouldThrow):\n* JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-float32array.js: Added.\n(shouldThrow):\n* JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-float64array.js: Added.\n(shouldThrow):\n* JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-int16array.js: Added.\n(shouldThrow):\n* JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-int32array.js: Added.\n(shouldThrow):\n* JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-int8array.js: Added.\n(shouldThrow):\n* JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-uint16array.js: Added.\n(shouldThrow):\n* JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-uint32array.js: Added.\n(shouldThrow):\n* JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-uint8array.js: Added.\n(shouldThrow):\n* JSTests/stress/typedarray-constructor-jit-compliant-toindex-firstarg-uint8clampledarray.js: Added.\n(shouldThrow):\n* JSTests/stress/typedarray-constructor-toindex-length-before-allocatetypedarray-if-1st-arg-not-object.js: Added.\n(shouldThrow):\n(const.newTarget):\n* JSTests/test262/expectations.yaml:\n* Source/JavaScriptCore/dfg/DFGOperations.cpp:\n* Source/JavaScriptCore/runtime/JSGenericTypedArrayViewConstructorInlines.h:\n(JSC::constructGenericTypedArrayViewWithArguments):\n(JSC::operationConstructGenericTypedArrayViewWithOneArgumentImpl):\n(JSC::constructGenericTypedArrayViewImpl):\n\nCanonical link: https://commits.webkit.org/316237@main",
      "email": "tetsuharu.ohzeki@gmail.com",
      "hash": "b50d777c02d0b7be29979e7c0fe50d678918cb09",
      "subject": "[JSC] test262 fail: test/built-ins/TypedArrayConstructors/ctors/typedarray-arg/throw-type-error-before-custom-proto-access.js"
    },
    "316238@main": {
      "author": "Phinehas Fuachie",
      "avatar": "https://www.gravatar.com/avatar/900d85de8c325e38975f39115c36bb75?d=identicon\u0026s=64",
      "cl": "316238@main",
      "clUrl": "https://commits.webkit.org/316238@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318262\nrdar://180028219\n\nReviewed by Jer Noble.\n\nWhen the video starts transitioning into dock mode, the Safari window briefly becomes visible\nunderneath, so YouTube's own caption layer (.ytp-caption-window-container) shows up at the same\ntime the docked player is rendering the mirror text track. The result is two copies of the same\ncaption stacked on top of each other for about a second, until the animation finishes and Safari\nis hidden again.\n\nHide YouTube's caption container whenever the mirror track is showing, and put it back when the\ntrack goes hidden. The MutationObserver keeps observing the container even while it's hidden, so\nthe mirror track still picks up new captions.\n\n* Source/WebCore/Modules/modern-media-controls/media/YouTubeCaptionQuirk.js:\n(CaptionMirror.prototype._handlePresentationModeChanged):\n\nCanonical link: https://commits.webkit.org/316238@main",
      "email": "pfuachie2@apple.com",
      "hash": "246579d526ad461ced533b174c68351f30f4b494",
      "subject": "[visionOS] YouTube captions briefly duplicate at the start of docking to sys environment"
    },
    "316239@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316239@main",
      "clUrl": "https://commits.webkit.org/316239@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318206\nrdar://181007995\n\nReviewed by Chris Dumez.\n\nThe local NeverDestroyed\u003cQualifiedName\u003e in langAttributeName() was\ncopy-pasted from voiceAttributeName() and left named voiceAttr, even\nthough it holds the \"lang\" attribute name. Rename it to langAttr to\nmatch its purpose.\n\n* Source/WebCore/html/track/WebVTTElement.h:\n* LayoutTests/imported/w3c/web-platform-tests/webvtt/api/VTTCue/getCueAsHTML-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/webvtt/api/VTTCue/getCueAsHTML.html:\nExtend the existing getCueAsHTML() test with \u003clang\u003e coverage (lang-\u003elang attribute)\nalongside the existing \u003cv\u003e (voice-\u003etitle) cases, exercising langAttributeName()'s observable output.\n\nCanonical link: https://commits.webkit.org/316239@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "87042c9e527f0ba62006d1ac84347743bb0bc079",
      "subject": "Misnamed local static voiceAttr in WebVTTElement::langAttributeName()"
    },
    "316240@main": {
      "author": "Abrar Rahman Protyasha",
      "avatar": "https://www.gravatar.com/avatar/fce5b3c4e9f3c59a4873e08c9f03c3b1?d=identicon\u0026s=64",
      "cl": "316240@main",
      "clUrl": "https://commits.webkit.org/316240@main",
      "description": "rdar://175672657\n\nReviewed by Wenson Hsieh.\n\nIn 298821@main, we taught WKMouseInteraction to copy the\nmouseMovedHandler block from the current GCMouse. However, since\nWKMouseInteraction does not have ARC, the bare copy did not increase the\nretain count of the block in question. Given we set a new block\nimmediately afterwards, the block we had just copied is released.\n\nOn a second RequestPointerLock IPC, the original mouseMovedHandler block\npoints to freed memory from the earlier IPC dance, and we end up with a\nuse-after-free.\n\nTo address this issue, we change the bare GCMouseMoved instance held on\nby WKMouseInteraction to a BlockPtr. This ensures that the handler is\nretained across the setter. Also, we add a pointerLockState.isActive gate\nat the start of -beginPointerLockMouseTracking, so successive pointer\nlock IPC messages would not be able to read a mouseMovedHandler block\nfrom a previous lock regardless. Finally, we promote our UI process\nm_isPointerLocked debug assertions into MESSAGE_CHECK invariants, which\nwould surface issues more readily in non-debug configurations (and,\nimportantly, without leading to a use-after-free in the process).\n\nTest: ipc/pointer-lock-double-lock-uaf.html\n\n* LayoutTests/ipc/pointer-lock-double-lock-uaf-expected.txt: Added.\n* LayoutTests/ipc/pointer-lock-double-lock-uaf.html: Added.\n* LayoutTests/platform/wk2/TestExpectations:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::WebPageProxy::requestPointerLock):\n(WebKit::WebPageProxy::didAllowPointerLock):\n(WebKit::WebPageProxy::didDenyPointerLock):\n* Source/WebKit/UIProcess/ios/WKMouseInteraction.mm:\n(-[WKMouseInteraction beginPointerLockMouseTracking]):\n(-[WKMouseInteraction endPointerLockMouseTracking]):\n(-[WKMouseInteraction _setupMouseMovedHandlerForMouse:]):\n* Tools/WebKitTestRunner/Configurations/WebKitTestRunnerApp.xcconfig:\n* Tools/WebKitTestRunner/TestController.h:\n* Tools/WebKitTestRunner/ios/TestControllerIOS.mm:\n(WTR::FakeMouseDevice::FakeMouseDevice):\n(WTR::FakeMouseDevice::~FakeMouseDevice):\n(WTR::TestController::platformResetStateToConsistentValues):\n(WTR::TestController::setHasMouseDeviceForTesting):\n  Enhance TestRunner.setHasMouseDeviceForTesting() to also swizzle a\n  fake GCMouse instance for testing, so that the system thinks an\n  external mouse input device is connected. This matches TWKAPI's\n  pointer lock test capabilities, and allows pointer lock tests to\n  get past the GCMouse gate in -beginPointerLockMouseTracking.\n\nOriginally-landed-as: 305413.755@safari-7624-branch (3927a3556654). rdar://181074364\nCanonical link: https://commits.webkit.org/316240@main",
      "email": "a_protyasha@apple.com",
      "hash": "ffe2ea6689b543ec54a86570650be46c723f309d",
      "subject": "REGRESSION(298821@main): [iOS] RequestPointerLock IPC twice in succession can produce use-after-free of unretained GCMouseMoved block in WKMouseInteraction"
    },
    "316241@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316241@main",
      "clUrl": "https://commits.webkit.org/316241@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318192\nrdar://181000174\n\nReviewed by Chris Dumez.\n\nnextLineCandidatePosition() takes an EditableType parameter and threads it\nthrough every call to nextLeafWithSameEditability() except the first\nskip-to-next-line loop, which hardcoded ContentIsEditable. This is\ninconsistent with the symmetric previousLineCandidatePosition(), which uses\nthe editableType argument consistently.\n\nThere is no behavior change from this patch: every caller reaching this loop\npasses ContentIsEditable (the default EditableType), so the hardcoded value\nalready matched the argument in practice. However, the code was very fragile,\nso this is to fix it.\n\nPass editableType through to nextLeafWithSameEditability() so the loop\nrespects the requested editability type and stays consistent with\npreviousLineCandidatePosition().\n\n* Source/WebCore/editing/VisibleUnits.cpp:\n(WebCore::nextLineCandidatePosition):\n\nCanonical link: https://commits.webkit.org/316241@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "8e78299db4970d7e9faffc8812c725687e88138a",
      "subject": "nextLineCandidatePosition ignores editableType parameter and hardcodes ContentIsEditable"
    },
    "316242@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316242@main",
      "clUrl": "https://commits.webkit.org/316242@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318196\nrdar://181001492\n\nReviewed by Chris Dumez.\n\nDictationCommandIOS::doApply() and Editor::setDictationPhrasesAsChildOfElement()\nboth built the \"alternatives\" Vector by copying the entire interpretations\nVector and then calling removeAt(0). removeAt(0) shifts every remaining element\ndown by one, so this was an O(n) copy followed by a second O(n) front-shift.\n\nUse subvector(1) directly instead, which copies the tail directly in a single\npass and drops the first interpretation without any shifting.\n\nNo change in behavior, so no new tests.\n\n* Source/WebCore/editing/ios/DictationCommandIOS.cpp:\n(WebCore::DictationCommandIOS::doApply):\n* Source/WebCore/editing/ios/EditorIOS.mm:\n(WebCore::Editor::setDictationPhrasesAsChildOfElement):\n\nCanonical link: https://commits.webkit.org/316242@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "9aa3d110dc34bbb756d78c82b05e2cbe1de4c12b",
      "subject": "Avoid O(n) front-shift when building dictation alternatives Vector"
    },
    "316243@main": {
      "author": "Basuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/5192a1151c7575317affb7a4633f8d63?d=identicon\u0026s=64",
      "cl": "316243@main",
      "clUrl": "https://commits.webkit.org/316243@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318179\nrdar://180989960\n\nReviewed by Sihui Liu.\n\nUnder multi-process BFCache with Site Isolation, restoring a back/forward-cached\npage that has cross-site iframes crashed the WebProcess in CachedPage::restore\nwith ASSERTION FAILED: !page.subframeCount(), followed by a scrolling-state\nLayerRepresentation assert.\n\nThe crash is in the multi-process BFCache restore path (WebPage::restoreWithFrameItem\n-\u003e CachedPage::restore), reached only in an iframe process where the live page's\nmain frame is a RemoteFrame. Unlike the main-frame commit path\n(FrameLoader::commitProvisionalLoad -\u003e detachChildren, and\nWebPageProxy::commitProvisionalPage -\u003e removeChildFrames), the iframe-process\nrestore path is a bare take() + restore() with no step to tear down the outgoing\npage's child frames. The residual live subframes belong to the outgoing\nnavigation, so CachedPage::restore's no-subframes precondition is violated and the\nassertion fires.\n\nDetach the live page's residual subframes in WebPage::restoreWithFrameItem\nimmediately before CachedPage::restore, mirroring FrameLoader::detachChildren()\nfor LocalFrame children and WebFrame::removeFromTree() for RemoteFrame children.\nThe teardown only runs in an iframe process, where the main frame is a RemoteFrame\nand every direct child belongs to the outgoing navigation, so detaching all\nchildren is safe; an assertion documents that invariant.\n\nThe added test loads two same-site pages that each embed a cross-site iframe, so\nthe back/forward item has a BFCache entry but no SuspendedPageProxy and goBack\nrestores via goToBackForwardItem's cached-children path, dispatching\nRestoreWithFrameItem directly to the iframe process while the outgoing page's\nsubframe is still attached. Without this change the assertion fired on every run;\nwith it the iframe process survives the restore.\n\n* Source/WebKit/WebProcess/WebPage/WebPage.cpp:\n(WebKit::WebPage::restoreWithFrameItem):\n(WebKit::WebPage::detachResidualSubframesForBackForwardCacheRestore):\n* Source/WebKit/WebProcess/WebPage/WebPage.h:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/SiteIsolation.mm:\n(TEST): Added MultiProcessBFCacheRestoreWithCrossSiteIframeDoesNotCrash.\n\nCanonical link: https://commits.webkit.org/316243@main",
      "email": "basuke@apple.com",
      "hash": "32ebbb5d6ca3e7d952777b3a58cd100161bc2058",
      "subject": "[BFCache][Site Isolation] CachedPage::restore asserts !page.subframeCount() during RestoreWithFrameItem when restoring a BFCached page with cross-site iframes"
    },
    "316244@main": {
      "author": "Charlie Wolfe",
      "avatar": "https://www.gravatar.com/avatar/857b3b5ff3394c31fa2689310a93dbab?d=identicon\u0026s=64",
      "cl": "316244@main",
      "clUrl": "https://commits.webkit.org/316244@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312445\nrdar://174702490\n\nReviewed by Rupin Mittal.\n\nA compromised WebContent process could forge treatAsSameOriginNavigation in\nDecidePolicyForNavigationAction to skip the cross-site process swap in processForNavigationInternal.\n\nRemove the field from NavigationActionData, NavigationAction, and API::Navigation, and compute it\ndirectly in processForNavigationInternal from the target URL protocol and the UIProcess-owned\nsourceURL.\n\n* Source/WebCore/loader/NavigationAction.cpp:\n(WebCore::shouldTreatAsSameOriginNavigation): Deleted.\n* Source/WebCore/loader/NavigationAction.h:\n(WebCore::NavigationAction::treatAsSameOriginNavigation const): Deleted.\n* Source/WebKit/Shared/NavigationActionData.h:\n* Source/WebKit/Shared/NavigationActionData.serialization.in:\n* Source/WebKit/UIProcess/API/APINavigation.h:\n(API::Navigation::treatAsSameOriginNavigation const): Deleted.\n* Source/WebKit/UIProcess/WebProcessPool.cpp:\n(WebKit::WebProcessPool::processForNavigationInternal):\n* Source/WebKit/UIProcess/win/AutomationSessionClientWin.cpp:\n(WebKit::AutomationSessionClient::requestNewPageWithOptions):\n* Source/WebKit/WebProcess/WebCoreSupport/WebChromeClient.cpp:\n(WebKit::WebChromeClient::createWindow):\n* Source/WebKit/WebProcess/WebCoreSupport/WebFrameLoaderClient.cpp:\n(WebKit::WebFrameLoaderClient::navigationActionData const):\n* Source/WebKit/WebProcess/WebCoreSupport/WebLocalFrameLoaderClient.cpp:\n(WebKit::WebLocalFrameLoaderClient::didSameDocumentNavigationForFrameViaJS):\n(WebKit::WebLocalFrameLoaderClient::dispatchDecidePolicyForNewWindowAction):\n\nOriginally-landed-as: 305413.684@safari-7624-branch (8bb359efde80). rdar://180435329\nCanonical link: https://commits.webkit.org/316244@main",
      "email": "charliew@apple.com",
      "hash": "6703af8d68a100de6bee755fb1887b10a5b2756b",
      "subject": "Remove treatAsSameOriginNavigation from NavigationActionData IPC"
    },
    "316245@main": {
      "author": "Basuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/5192a1151c7575317affb7a4633f8d63?d=identicon\u0026s=64",
      "cl": "316245@main",
      "clUrl": "https://commits.webkit.org/316245@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317796\nrdar://180371329\n\nReviewed by Rupin Mittal.\n\nWhen a navigation in a cross-origin iframe is initiated by an element in the\nembedding document (for example, an \u003ca\u003e with target= pointing into the iframe),\nNavigateEvent.sourceElement received inside the iframe was the parent's element\nitself, with full DOM access via event.sourceElement.ownerDocument. This let\nthe iframe read arbitrary content from the embedder's document, bypassing the\nsame-origin policy.\n\nNull out sourceElement in Navigation::innerDispatchNavigateEvent when its\nowning document is not same-origin-domain with the navigation's relevant\ndocument. The check sits at the central dispatch funnel after the form\nsubmitter/form rewrite, so anchor, form, submitter, and download paths are\ncovered uniformly.\n\nThe upstream WPT navigation-api/navigate-event/sourceElement-cross-origin.sub.html\nalready covered this case as a baseline failure; flipped to PASS. Added a\nWebKit HTTP/WPT regression test that exercises the leak with private\nparent-document data so the bypass scenario is explicit.\n\n* LayoutTests/http/wpt/navigation-api/resources/sourceElement-cross-origin-leak-frame.html: Added.\n* LayoutTests/http/wpt/navigation-api/sourceElement-cross-origin-leak.sub-expected.txt: Added.\n* LayoutTests/http/wpt/navigation-api/sourceElement-cross-origin-leak.sub.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/navigation-api/navigate-event/sourceElement-cross-origin.sub-expected.txt:\n* Source/WebCore/page/Navigation.cpp:\n(WebCore::Navigation::innerDispatchNavigateEvent):\n\nCanonical link: https://commits.webkit.org/316245@main",
      "email": "basuke@apple.com",
      "hash": "0beaf193cc762422145d23259b6d039796135c0f",
      "subject": "Cross-origin parent DOM exposed via NavigateEvent.sourceElement"
    },
    "316246@main": {
      "author": "Kimmo Kinnunen",
      "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64",
      "cl": "316246@main",
      "clUrl": "https://commits.webkit.org/316246@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318214\nrdar://181016883\n\nReviewed by Pascoe, Alex Christensen, and Zak Ridouh.\n\nCopy the media control images to build\nWebCore.framework/Versions/A/Resources/modern-media-controls/images\ndirectory. Otherwise layout tests fail due to console messages\nabout missing icons.\n\n* Source/WebCore/PlatformMac.cmake:\n\nCanonical link: https://commits.webkit.org/316246@main",
      "email": "kkinnunen@apple.com",
      "hash": "22be39cad5fb97fa623f8e59e9a7504d462384b3",
      "subject": "CMake: Media tests fail due to missing media control images"
    },
    "316247@main": {
      "author": "Kimmo Kinnunen",
      "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64",
      "cl": "316247@main",
      "clUrl": "https://commits.webkit.org/316247@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318215\nrdar://181017732\n\nReviewed by Brent Fulgham.\n\nAdd SoftLink.h includes as last includes to avoid style checker\nerrors.\n\n* Source/WebKit/Scripts/generate-serializers.py:\n(generate_impl):\n* Source/WebKit/Scripts/webkit/tests/GeneratedSerializers.cpp:\n* Source/WebKit/Scripts/webkit/tests/GeneratedSerializersExtra.h: Added.\n\nCanonical link: https://commits.webkit.org/316247@main",
      "email": "kkinnunen@apple.com",
      "hash": "cc6164615e73692de385a93b985a7c243ceb0b03",
      "subject": "GeneratedSerializers should include soft link headers last"
    },
    "316248@main": {
      "author": "Kimmo Kinnunen",
      "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64",
      "cl": "316248@main",
      "clUrl": "https://commits.webkit.org/316248@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312970\nrdar://174740081\n\nReviewed by Dan Glastonbury.\n\nNested loops would not be categorized as potentially infinite if the\nwrite to the condition variable happened inside the loop initializer,\ncondition or expression.\n\nAlso, loops would not be categorized as potentially infinite if the\nexpression was a simple function call.\n\nFix first by traversing the loop initializer, condition and expression.\n\nFix the second by adding the missing case for all unhandled patterns\nin the expression to mark the loop as potentially infinite.\n\n* Source/ThirdParty/ANGLE/ANGLE.xcodeproj/project.pbxproj:\n* Source/ThirdParty/ANGLE/Configurations/utils.xcconfig:\n* Source/ThirdParty/ANGLE/src/compiler/translator/tree_ops/msl/EnsureLoopForwardProgress.cpp:\n* Source/ThirdParty/ANGLE/src/tests/gl_tests/GLSLOutputTest.cpp:\n\nOriginally-landed-as: 305413.720@safari-7624-branch (58b3c28331a0). rdar://180429427\nCanonical link: https://commits.webkit.org/316248@main",
      "email": "kkinnunen@apple.com",
      "hash": "6d057b78639f6b8b413c1593dfc5c686e64fad16",
      "subject": "ANGLE: EnsureLoopForwardProgress misses nested loop inititializers, expressions"
    },
    "316249@main": {
      "author": "Kimmo Kinnunen",
      "avatar": "https://www.gravatar.com/avatar/7f063a2c9e40666bfe998109608180b7?d=identicon\u0026s=64",
      "cl": "316249@main",
      "clUrl": "https://commits.webkit.org/316249@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312977\n\u003crdar://174740337\u003e\n\nReviewed by Dan Glastonbury.\n\nResumeTransformFeedback should succeed only when the current\nprogram is the program of the active transform feedback.\n\nFix by adding a validation step for this.\n\n* Source/ThirdParty/ANGLE/src/libANGLE/ErrorStrings.h:\n* Source/ThirdParty/ANGLE/src/libANGLE/validationES3.cpp:\n(gl::ValidateResumeTransformFeedback):\n* Source/ThirdParty/ANGLE/src/tests/gl_tests/TransformFeedbackTest.cpp:\n\nOriginally-landed-as: 305413.721@safari-7624-branch (146668c5ca43). rdar://180435246\nCanonical link: https://commits.webkit.org/316249@main",
      "email": "kkinnunen@apple.com",
      "hash": "bec77c5e331513ebb1c9e7ca134b00281e145877",
      "subject": "ANGLE: ResumeTransformFeedback does not validate the active program"
    },
    "316250@main": {
      "author": "Antoine Quint",
      "avatar": "https://www.gravatar.com/avatar/9b3ef1e754f8d994f21ff67c660cbbe6?d=identicon\u0026s=64",
      "cl": "316250@main",
      "clUrl": "https://commits.webkit.org/316250@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318226\nrdar://180912517\n\nReviewed by Simon Fraser.\n\nIf an animation that targets a property that can be accelerated is associated with a document timeline,\nwe always allow acceleration by virtue of `DocumentTimeline::canBeAccelerated()` returning `true`. However,\nthat `DocumentTimeline` may be associated with a document that is not associated with a `LocalDOMWindow`,\nwhich is required to perform time computations in `DocumentTimeline::createAcceleratedRepresentation()`.\n\nSo we now check that we have a valid `window()` in `DocumentTimeline::canBeAccelerated()`.\n\nThis fix was automatically suggested by an LLM during bug analysis, I validated its approach.\n\nTest: webanimations/animation-associated-with-external-document-timeline.html\n\n* LayoutTests/webanimations/animation-associated-with-external-document-timeline-expected.txt: Added.\n* LayoutTests/webanimations/animation-associated-with-external-document-timeline.html: Added.\n* Source/WebCore/animation/DocumentTimeline.cpp:\n(WebCore::DocumentTimeline::canBeAccelerated const):\n* Source/WebCore/animation/DocumentTimeline.h:\n\nCanonical link: https://commits.webkit.org/316250@main",
      "email": "graouts@webkit.org",
      "hash": "b9dbeb655123e9dc8a5202e71f797c60f37b50be",
      "subject": "[threaded-animations] animation associated with external document timeline crashes under `DocumentTimeline::createAcceleratedRepresentation()`"
    },
    "316251@main": {
      "author": "Per Arne Vollan",
      "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64",
      "cl": "316251@main",
      "clUrl": "https://commits.webkit.org/316251@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312846\nrdar://174670487\n\nReviewed by Brent Fulgham.\n\nThe Network process should not create form data sandbox extensions for a set\nof locations that it has read access to in the sandbox. This patch defines\nthat set, and prevents sandbox extensions from being created and consumed\nwhen these unexpected locations are being used in form data.\n\nTest: WebKit.BlockedUploadDirectory\n\n* Source/WebKit/NetworkProcess/NetworkProcess.cpp:\n(WebKit::getDarwinCacheDir):\n(WebKit::getDarwinTempDir):\n(WebKit::addPathsBlockedForSandboxExtensions):\n(WebKit::NetworkProcess::addStorageSession):\n* Source/WebKit/Platform/IPC/FormDataReference.h:\n(IPC::FormDataReference::FormDataReference):\n(IPC::FormDataReference::sandboxExtensionHandles const):\n* Source/WebKit/Shared/AuxiliaryProcess.h:\n* Source/WebKit/Shared/WebsiteDataStoreParameters.h:\n* Source/WebKit/Shared/WebsiteDataStoreParameters.serialization.in:\n* Source/WebKit/Shared/mac/AuxiliaryProcessMac.mm:\n(WebKit::AuxiliaryProcess::getHomeDirectory):\n(WebKit::populateSandboxInitializationParameters):\n(WebKit::getHomeDirectory): Deleted.\n* Source/WebKit/Shared/Cocoa/PathsBlockedForSandboxExtensions.h: Added.\n* Source/WebKit/Shared/Cocoa/PathsBlockedForSandboxExtensions.mm: Added.\n* Source/WebKit/UIProcess/WebsiteData/Cocoa/WebsiteDataStoreCocoa.mm:\n(WebKit::libraryRootDirectory):\n(WebKit::WebsiteDataStore::platformSetNetworkParameters):\n* Source/WebKit/UIProcess/WebsiteData/WebsiteDataStore.cpp:\n(WebKit::WebsiteDataStore::parameters):\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebKitCocoa/UploadDirectory.mm:\n(TEST(WebKit, UploadDirectory)):\n(TEST(WebKit, BlockedUploadDirectory)):\n\nOriginally-landed-as: 305413.785@safari-7624-branch (f6680b7bcc5c). rdar://180427740\nCanonical link: https://commits.webkit.org/316251@main",
      "email": "pvollan@apple.com",
      "hash": "022bc68dc5f93a364c8a30b093664e6fb16ae565",
      "subject": "The Network process should not create form data sandbox extensions"
    },
    "316252@main": {
      "author": "Jean-Yves Avenard",
      "avatar": "https://www.gravatar.com/avatar/509313899deeb9262fad8f5e04093f5b?d=identicon\u0026s=64",
      "cl": "316252@main",
      "clUrl": "https://commits.webkit.org/316252@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318154\nrdar://180963394\n\nReviewed by Jer Noble.\n\nMake use of the new PlatformTimeRanges::span() where possible.\n\nNo change in behaviour.\n\n* Source/WebCore/Modules/mediasource/MediaSource.cpp:\n(WebCore::MediaSource::streamEndedWithError):\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::maxBufferedTime const):\n* Source/WebCore/platform/graphics/MediaSourcePrivate.cpp:\n(WebCore::MediaSourcePrivate::computeBufferedRanges):\n* Source/WebCore/platform/graphics/PlatformTimeRanges.cpp:\n(WebCore::PlatformTimeRanges::containWithEpsilon const):\n* Source/WebCore/platform/graphics/TrackBuffer.cpp:\n(WebCore::TrackBuffer::removeSamples):\n* Source/WebCore/platform/mock/mediasource/MockMediaPlayerMediaSource.cpp:\n(WebCore::MockMediaPlayerMediaSource::advanceCurrentTime):\n* Source/WebKit/Platform/ios/PlaybackSessionInterfaceLMK.mm:\n(WebKit::PlaybackSessionInterfaceLMK::seekableRangesChanged):\n\nCanonical link: https://commits.webkit.org/316252@main",
      "email": "jya@apple.com",
      "hash": "b035c5f53fa51e400c87834e7fb1316d8533aadc",
      "subject": "Use PlatformTimeRanges::span instead of start(index)/end(index) methods"
    },
    "316253@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316253@main",
      "clUrl": "https://commits.webkit.org/316253@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312449\nrdar://174655475\n\nReviewed by Ryosuke Niwa.\n\nBlobResourceHandleBase was passing a mutable span to its m_buffer Vector\nto AsyncFileStream for it to write into asynchronously on a background\nthread. However, nothing guaranteed that the BlobResourceHandleBase\n(and thus its m_buffer) stayed alive until AsyncFileStream was done\nwriting.\n\nAddress the issue by using a `Box\u003cVector\u003cuint8_t\u003e\u003e` instead of a simple\nVector so that the buffer is now ThreadSafeRefCounted. Then update the\nAsyncFileStream API to take in a `Box\u003cVector\u003cuint8_t\u003e\u003e` instead of a\nspan.\n\nFor further hardening, I removed the non-const buffer getter on\nBlobResourceHandleBase. This was too dangerous because any operation on\nthis buffer on the main thread could cause the background thread to\ncrash if it is currently writing to it. The non-const buffer getter was\nonly used to resize the buffer once we know the size of the data we\nneed to read. I thus added a more specific `resizeBuffer()` API to\nBlobResourceHandleBase which has a RELEASE_ASSERT() to guarantee that\nthe background thread is NOT currently writing into the buffer. This was\nnot an issue with the current code but the RELEASE_ASSERT() makes sure\nwe cannot introduce such a security bug in the future.\n\n* Source/WebCore/fileapi/AsyncFileStream.cpp:\n(WebCore::AsyncFileStream::read):\n* Source/WebCore/fileapi/AsyncFileStream.h:\n* Source/WebCore/platform/FileStreamClient.h:\n(WebCore::FileStreamClient::didGetSize):\n(WebCore::FileStreamClient::didRead): Deleted.\n* Source/WebCore/platform/network/BlobResourceHandle.cpp:\n(WebCore::BlobResourceHandle::didReceiveResponse):\n* Source/WebCore/platform/network/BlobResourceHandleBase.cpp:\n(WebCore::BlobResourceHandleBase::BlobResourceHandleBase):\n(WebCore::BlobResourceHandleBase::resizeBuffer):\n(WebCore::BlobResourceHandleBase::readFileAsync):\n(WebCore::BlobResourceHandleBase::didRead):\n* Source/WebCore/platform/network/BlobResourceHandleBase.h:\n* Source/WebKit/NetworkProcess/NetworkDataTaskBlob.cpp:\n(WebKit::NetworkDataTaskBlob::didReceiveResponse):\n\nOriginally-landed-as: 305413.682@safari-7624-branch (70917758773a). rdar://180428931\nCanonical link: https://commits.webkit.org/316253@main",
      "email": "cdumez@apple.com",
      "hash": "629adf4b07f2d5d71ff096c95de0ed67da38ded5",
      "subject": "Cross-Thread UAF Write in AsyncFileStream::read via NetworkDataTaskBlob"
    },
    "316254@main": {
      "author": "Sosuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/e63b87350fe19bdd9a30c7234eda45af?d=identicon\u0026s=64",
      "cl": "316254@main",
      "clUrl": "https://commits.webkit.org/316254@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318185\n\nReviewed by Yusuke Suzuki.\n\nThis patch adds StringPrototypeTrimIntrinsic, StringPrototypeTrimStartIntrinsic, and\nStringPrototypeTrimEndIntrinsic, and handles them in DFG and FTL via a new StringTrim\nnode. For now, the DFG / FTL implementation simply speculates StringUse on the receiver\nand calls a JIT operation. We can optimize this further in future patches, e.g. by\nemitting the whitespace scan as inline JIT code and allocating the substring rope inline.\n\nThis patch also updates the existing string-trim* microbenchmarks so that they consume\nthe trim results and rotate the input strings: since StringTrim is a pure node, the\nprevious result-discarding loop bodies were eliminated by DCE / LICM and no longer\nmeasured trim itself.\n\n                                                 ToT                     Patched\n\nstring-trim-start-unicode-whitespace       45.2619+-0.9021     ^     39.7963+-0.8249        ^ definitely 1.1373x faster\nstring-trim-end-unicode-whitespace         47.1853+-1.1061     ^     42.3641+-1.0792        ^ definitely 1.1138x faster\nstring-trim-whitespace                    112.0596+-1.8629     ^     49.2140+-0.8692        ^ definitely 2.2770x faster\nstring-trim-no-whitespace                  41.4868+-0.6042     ^     17.3533+-0.3159        ^ definitely 2.3907x faster\nstring-trim                                82.4187+-0.9117     ^     40.3063+-1.9017        ^ definitely 2.0448x faster\nstring-trim-unicode-whitespace             81.8615+-2.1368     ^     75.6034+-1.9905        ^ definitely 1.0828x faster\nstring-trim-end                            76.7737+-1.0939     ^     36.0213+-0.4923        ^ definitely 2.1313x faster\nstring-trim-start                          76.8228+-0.7388     ^     32.7010+-1.0362        ^ definitely 2.3492x faster\n\nTests: JSTests/microbenchmarks/string-trim-no-whitespace.js\n       JSTests/microbenchmarks/string-trim-whitespace.js\n       JSTests/stress/string-trim-intrinsic.js\n\n* JSTests/microbenchmarks/string-trim-end-unicode-whitespace.js:\n* JSTests/microbenchmarks/string-trim-end.js:\n* JSTests/microbenchmarks/string-trim-no-whitespace.js: Added.\n(test):\n* JSTests/microbenchmarks/string-trim-start-unicode-whitespace.js:\n* JSTests/microbenchmarks/string-trim-start.js:\n* JSTests/microbenchmarks/string-trim-unicode-whitespace.js:\n* JSTests/microbenchmarks/string-trim-whitespace.js: Added.\n(test):\n* JSTests/microbenchmarks/string-trim.js:\n* JSTests/stress/string-trim-intrinsic.js: Added.\n(shouldBe):\n(testTrim):\n(testTrimStart):\n(testTrimEnd):\n(shouldBe.String.prototype.trim.call.toString):\n(testTrimPolymorphic):\n* Source/JavaScriptCore/dfg/DFGAbstractInterpreterInlines.h:\n(JSC::DFG::AbstractInterpreter\u003cAbstractStateType\u003e::executeEffects):\n* Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp:\n(JSC::DFG::ByteCodeParser::handleIntrinsicCall):\n* Source/JavaScriptCore/dfg/DFGClobberize.h:\n(JSC::DFG::clobberize):\n* Source/JavaScriptCore/dfg/DFGCloneHelper.h:\n* Source/JavaScriptCore/dfg/DFGDoesGC.cpp:\n(JSC::DFG::doesGC):\n* Source/JavaScriptCore/dfg/DFGFixupPhase.cpp:\n(JSC::DFG::FixupPhase::fixupNode):\n* Source/JavaScriptCore/dfg/DFGNode.h:\n(JSC::DFG::Node::hasIntrinsic):\n* Source/JavaScriptCore/dfg/DFGNodeType.h:\n* Source/JavaScriptCore/dfg/DFGOperations.cpp:\n(JSC::DFG::stringTrimImpl):\n(JSC::DFG::JSC_DEFINE_JIT_OPERATION):\n* Source/JavaScriptCore/dfg/DFGOperations.h:\n* Source/JavaScriptCore/dfg/DFGPredictionPropagationPhase.cpp:\n* Source/JavaScriptCore/dfg/DFGSafeToExecute.h:\n(JSC::DFG::safeToExecute):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.cpp:\n(JSC::DFG::SpeculativeJIT::compileStringTrim):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT.h:\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT32_64.cpp:\n(JSC::DFG::SpeculativeJIT::compile):\n* Source/JavaScriptCore/dfg/DFGSpeculativeJIT64.cpp:\n(JSC::DFG::SpeculativeJIT::compile):\n* Source/JavaScriptCore/ftl/FTLCapabilities.cpp:\n(JSC::FTL::canCompile):\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileNode):\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n* Source/JavaScriptCore/runtime/Intrinsic.h:\n* Source/JavaScriptCore/runtime/StringPrototype.cpp:\n(JSC::StringPrototype::finishCreation):\n(JSC::trimString):\n* Source/JavaScriptCore/runtime/StringPrototypeInlines.h:\n(JSC::extractTrimOffsets):\n\nCanonical link: https://commits.webkit.org/316254@main",
      "email": "sosuke@bun.sh",
      "hash": "082efc20347d20d555bc7c5fb2c349e791495859",
      "subject": "[JSC] Handle `String#trim`, `String#trimStart` and `String#trimEnd` in DFG / FTL"
    },
    "316255@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "316255@main",
      "clUrl": "https://commits.webkit.org/316255@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318042\n\u003crdar://problem/181017761\u003e\n\nReviewed by Antti Koivisto.\n\nclientWidth/clientHeight/clientLeft/clientTop and clientBoxRect are DOM concepts\n(Element.clientWidth and friends) that on RenderBox were just thin aliases over\nlayout geometry: clientWidth is paddingBoxWidth, clientLeft is borderLeft, and\nclientBoxRect is a padding-box-sized rect placed at the border-box origin.\n\nRemove them and point every caller, including the DOM Element::client*\nimplementations, straight at paddingBox*/border*. Add\npaddingBoxLogicalWidth/Height/Bottom to mirror contentBoxLogical* for the former\nclientLogical* callers, and rename flippedClientBoxRect to flippedPaddingBoxRect\nsince it returns the flipped padding box used for overflow rectangles, not a DOM\nrect.\n\nNo behavior change.\n\n* Source/WebCore/dom/Element.cpp:\n(WebCore::Element::clientLeft):\n(WebCore::Element::clientTop):\n(WebCore::Element::clientWidth):\n(WebCore::Element::clientHeight):\n* Source/WebCore/editing/EditorCommand.cpp:\n(WebCore::verticalScrollDistance):\n* Source/WebCore/html/MediaElementSession.cpp:\n(WebCore::isElementLargeRelativeToMainFrame):\n(WebCore::isElementLargeEnoughForMainContent):\n* Source/WebCore/inspector/InspectorOverlay.cpp:\n(WebCore::buildRendererHighlight):\n* Source/WebCore/page/SpatialNavigation.cpp:\n(WebCore::scrollInDirection):\n(WebCore::canScrollInDirection):\n* Source/WebCore/rendering/RenderBlock.cpp:\n(WebCore::RenderBlock::simplifiedLayout):\n(WebCore::RenderBlock::layoutOverflowLogicalBottom):\n* Source/WebCore/rendering/RenderBlockFlow.cpp:\n(WebCore::RenderBlockFlow::layoutBlock):\n* Source/WebCore/rendering/RenderBox.cpp:\n(WebCore::RenderBox::scrollWidth const):\n(WebCore::RenderBox::scrollHeight const):\n(WebCore::absoluteInteractionBounds):\n(WebCore::RenderBox::containingBlockRangeForPositioned const):\n(WebCore::RenderBox::hasLayoutOverflow const):\n(WebCore::RenderBox::clampToAllowedLayoutOverflow):\n(WebCore::RenderBox::addLayoutOverflow):\n(WebCore::RenderBox::addMarginBoxOverflow):\n(WebCore::RenderBox::ensureOverflow):\n(WebCore::RenderBox::flippedPaddingBoxRect const):\n(WebCore::RenderBox::clientWidth const): Deleted.\n(WebCore::RenderBox::clientHeight const): Deleted.\n(WebCore::RenderBox::flippedClientBoxRect const): Deleted.\n* Source/WebCore/rendering/RenderBox.h:\n(WebCore::RenderBox::layoutOverflowRect const):\n(WebCore::RenderBox::hasHorizontalLayoutOverflow const):\n(WebCore::RenderBox::hasVerticalLayoutOverflow const):\n* Source/WebCore/rendering/RenderBoxInlines.h:\n(WebCore::RenderBox::marginBoxLogicalHeight const):\n(WebCore::RenderBox::paddingBoxLogicalBottom const):\n(WebCore::RenderBox::paddingBoxLogicalHeight const):\n(WebCore::RenderBox::paddingBoxLogicalWidth const):\n(WebCore::RenderBox::flippedContentBoxRect const):\n(WebCore::RenderBox::scrollablePaddingAreaOverflowRect const):\n(WebCore::RenderBox::clientBoxRect const): Deleted.\n(WebCore::RenderBox::clientLeft const): Deleted.\n(WebCore::RenderBox::clientLogicalBottom const): Deleted.\n(WebCore::RenderBox::clientLogicalHeight const): Deleted.\n(WebCore::RenderBox::clientLogicalWidth const): Deleted.\n(WebCore::RenderBox::clientTop const): Deleted.\n* Source/WebCore/rendering/RenderFragmentContainer.cpp:\n(WebCore::RenderFragmentContainer::computedLayoutOverflowRectForBox const):\n* Source/WebCore/rendering/RenderGrid.cpp:\n(WebCore::RenderGrid::gridAreaRangeForOutOfFlow const):\n(WebCore::RenderGrid::translateRTLCoordinate const):\n* Source/WebCore/rendering/RenderLayer.cpp:\n(WebCore::RenderLayer::visibleSize const):\n* Source/WebCore/rendering/RenderLayerScrollableArea.cpp:\n(WebCore::RenderLayerScrollableArea::hasHorizontalOverflow const):\n(WebCore::RenderLayerScrollableArea::hasVerticalOverflow const):\n(WebCore::RenderLayerScrollableArea::updateScrollbarSteps):\n* Source/WebCore/rendering/RenderListBox.cpp:\n(WebCore::RenderListBox::scrollWidth const):\n(WebCore::RenderListBox::scrollHeight const):\n* Source/WebCore/rendering/RenderMarquee.cpp:\n(WebCore::RenderMarquee::computePosition):\n(WebCore::RenderMarquee::timerFired):\n* Source/WebCore/rendering/RenderReplaced.cpp:\n(WebCore::RenderReplaced::computeConstrainedLogicalWidth const):\n* Source/WebCore/rendering/RenderTextControlSingleLine.cpp:\n(WebCore::RenderTextControlSingleLine::scrollWidth const):\n(WebCore::RenderTextControlSingleLine::scrollHeight const):\n* Source/WebCore/rendering/RenderTreeAsText.cpp:\n(WebCore::writeLayerUsingGeometryType):\n* Source/WebCore/rendering/RenderView.cpp:\n(WebCore::RenderView::clientLogicalWidthForFixedPosition const):\n(WebCore::RenderView::clientLogicalHeightForFixedPosition const):\n* Source/WebCore/rendering/ScrollbarUpdateScope.cpp:\n(WebCore::ScrollbarUpdateScope::~ScrollbarUpdateScope):\n* Source/WebKitLegacy/mac/WebCoreSupport/WebContextMenuClient.mm:\n(WebContextMenuClient::clientFloatRectForNode const):\n\nCanonical link: https://commits.webkit.org/316255@main",
      "email": "zalan@apple.com",
      "hash": "6a6bb4258c586afe702c77cda962322792dc5e86",
      "subject": "[cleanup] Remove the DOM-flavored client* API from RenderBox"
    },
    "316256@main": {
      "author": "Ruthvik Konda",
      "avatar": "https://www.gravatar.com/avatar/bca33cefcce93017251a8fbc1204cdc4?d=identicon\u0026s=64",
      "cl": "316256@main",
      "clUrl": "https://commits.webkit.org/316256@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313460\nrdar://174414109\n\nReviewed by Simon Fraser.\n\nThe WebProcess can send DynamicContentScalingDisplayList while prepareBufferForDisplay\nis still active on the GPU Process. This is semantically invalid.\n\nDynamicContentScalingDisplayList calls dynamicContentScalingDisplayList() on the\nfront buffer, which calls releaseGraphicsContext() — destroying the graphics context\nthat prepareBufferForDisplay is actively using through m_context. This leads to a\ndangling reference.\n\nThis is a variant of rdar://167565825 (939a2f7876f3) that survives the existing\nMESSAGE_CHECK on markSurfacesVolatile. Only reachable on PLATFORM(VISION) where\nENABLE(RE_DYNAMIC_CONTENT_SCALING) is defined.\n\nTo fix, we add a MESSAGE_CHECK to reject when dynamicContentScalingDisplayList is\ncalled while drawing is ongoing, mirroring the existing guard on markSurfacesVolatile.\n\nTest: ipc/dynamic-content-scaling-display-list-during-prepare-for-display.html\n\n* LayoutTests/ipc/dynamic-content-scaling-display-list-during-prepare-for-display-expected.txt: Added.\n* LayoutTests/ipc/dynamic-content-scaling-display-list-during-prepare-for-display.html: Added.\n* LayoutTests/platform/visionos/TestExpectations:\n* Source/WebKit/GPUProcess/graphics/RemoteImageBufferSet.cpp:\n(WebKit::RemoteImageBufferSet::dynamicContentScalingDisplayList):\n\nOriginally-landed-as: 305413.743@safari-7624-branch (5364d0966d20). rdar://180437851\nCanonical link: https://commits.webkit.org/316256@main",
      "email": "rkonda2@apple.com",
      "hash": "b63b114edafb1fcf440ef17c473a316dc9081c01",
      "subject": "Dynamic content scaling display lists should not be requested while preparing for display"
    },
    "316257@main": {
      "author": "Antti Koivisto",
      "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64",
      "cl": "316257@main",
      "clUrl": "https://commits.webkit.org/316257@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318322\nrdar://181107185\n\nReviewed by Alan Baradlay.\n\nIf a function is defined in a different scope than the caller the names in the function body\nmust be resolved in the definition scope.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/function-shadow-expected.txt:\n* Source/WebCore/animation/KeyframeEffect.cpp:\n(WebCore::KeyframeEffect::computeCSSAnimationBlendingKeyframes):\n* Source/WebCore/style/StyleScope.h:\n(WebCore::Style::resolveTreeScopedReference):\n(WebCore::Style::Scope::resolveTreeScopedReference): Deleted.\n\nProvide ScopedName resolved for the tested scope to the argument callable.\nAlso make standalone and use std::invocable concept for better error messages.\n\n* Source/WebCore/style/StyleSubstitutionContext.h:\n(WebCore::Style::add):\n\nInclude the function's scope in the substitution context so same-named functions in\ndifferent scopes are not treated as a cycle.\n\n* Source/WebCore/style/StyleSubstitutionResolver.cpp:\n(WebCore::Style::SubstitutionResolver::resolveAndRegisterDashedFunctionArguments):\n(WebCore::Style::SubstitutionResolver::substituteDashedFunction):\n\nInitialize body and argument declarations with the function scope, and key the cycle guard\non the resolved function scope.\n\n* Source/WebCore/style/StyleSubstitutionResolver.h:\n* Source/WebCore/style/StyleTreeResolver.cpp:\n(WebCore::Style::TreeResolver::generatePositionOption):\n* Source/WebCore/style/Styleable.cpp:\n(WebCore::keyframesRuleExistsForAnimation):\n\nCanonical link: https://commits.webkit.org/316257@main",
      "email": "antti@apple.com",
      "hash": "d0f53b880e13dd2d3c97dd7b55450fc5abf6cdb5",
      "subject": "[css-mixins-1] Resolve names in @function in the scope where the function was defined"
    },
    "316258@main": {
      "author": "Cole Carley",
      "avatar": "https://www.gravatar.com/avatar/091dd5641909acc46e581355f491ed34?d=identicon\u0026s=64",
      "cl": "316258@main",
      "clUrl": "https://commits.webkit.org/316258@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317803\nrdar://180571813\n\nReviewed by Yusuke Suzuki.\n\nThere is no address type mismatch check during import linking for external memory,\nwhich causes a bug in Memory64.\n\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.cpp:\n(JSC::JSWebAssemblyInstance::memoryInit):\n* Source/JavaScriptCore/wasm/js/JSWebAssemblyInstance.h:\n* Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp:\n(JSC::WebAssemblyModuleRecord::initializeImports):\n\nCanonical link: https://commits.webkit.org/316258@main",
      "email": "ccarley2@apple.com",
      "hash": "05b8559264081c931af39bd38bff38b1697c944f",
      "subject": "[Memory64] Missing memory address type mismatch check during import linking"
    },
    "316259@main": {
      "author": "Anand Srinivasan",
      "avatar": "https://www.gravatar.com/avatar/84643a20c269974c2df6681742daf0a4?d=identicon\u0026s=64",
      "cl": "316259@main",
      "clUrl": "https://commits.webkit.org/316259@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315365\nrdar://177030377\n\nReviewed by Yijia Huang.\n\nLegacy EH instructions are not defined in the wasm spec but are still\nsupported for backwards compatibility. Functions must either use legacy\nor standards compliant EH instructions but not both, and the streaming\ncompiler needs to be updated to enforce this.\n\nTest: JSTests/wasm/stress/streaming-compile-try-table-agreement.js\n\n* JSTests/wasm/stress/streaming-compile-try-table-agreement.js: Added.\n(compileNonStreaming):\n(async compileStreaming):\n(async main):\n* Source/JavaScriptCore/wasm/WasmEntryPlan.cpp:\n(JSC::Wasm::EntryPlan::compileFunctions):\n(JSC::Wasm::EntryPlan::failIfMixedExceptionHandlingProposals):\n* Source/JavaScriptCore/wasm/WasmEntryPlan.h:\n* Source/JavaScriptCore/wasm/WasmIPIntPlan.cpp:\n(JSC::Wasm::IPIntPlan::completeInStreaming):\n* Source/JavaScriptCore/wasm/WasmIPIntSlowPaths.cpp:\n(JSC::IPInt::rethrowSlotForDepth):\n(JSC::IPInt::WASM_IPINT_EXTERN_CPP_DECL):\n* Source/JavaScriptCore/wasm/WasmIPIntSlowPaths.h:\n\nOriginally-landed-as: 305413.963@safari-7624-branch (55fe8eb4c2a9). rdar://180437856\nCanonical link: https://commits.webkit.org/316259@main",
      "email": "anand_srinivasan@apple.com",
      "hash": "0f0de8f2a05829881df46dc2ac7e2799da0696ce",
      "subject": "Streaming compiler does not reject mixed legacy and spec-correct EH"
    },
    "316260@main": {
      "author": "Roberto Rodriguez",
      "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64",
      "cl": "316260@main",
      "clUrl": "https://commits.webkit.org/316260@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312951\nrdar://174740372\n\nReviewed by Kimmo Kinnunen.\n\nTextureMtl::retainImageDefinitions() populates mTexImageDefs with views of the old native\nstorage when the base level is resized. These stale views can survive\nensureNativeStorageCreated() when their dimensions don't match the new storage. A subsequent\ntexImage2D whose size matches the new storage takes the redefineImage() fast path, fetches\nthe stale undersized view, and issues a replaceRegion against it resulting in OOB write.\n\nIn the fast path, compare the cached view's size against the expected mip size and clear the\nentry when they differ. Valid views are left in place to avoid unnecessary recreation.\n\n* Source/ThirdParty/ANGLE/src/libANGLE/renderer/metal/TextureMtl.mm:\n(rx::TextureMtl::redefineImage):\n* Source/ThirdParty/ANGLE/src/tests/gl_tests/TextureTest.cpp:\n\nOriginally-landed-as: 305413.818@safari-7624-branch (656e32e254da). rdar://180428246\nCanonical link: https://commits.webkit.org/316260@main",
      "email": "roberto_rodriguez2@apple.com",
      "hash": "b3a18597e2c6f3f95e9e085fc9fcf05fed24c99e",
      "subject": "Clear stale imageDef in TextureMtl::redefineImage fast path"
    },
    "316261@main": {
      "author": "Eric Carlson",
      "avatar": "https://www.gravatar.com/avatar/e227ff07cc6d645fc1c69fd56c2c8cb8?d=identicon\u0026s=64",
      "cl": "316261@main",
      "clUrl": "https://commits.webkit.org/316261@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314115\nrdar://174411400\n\nReviewed by Youenn Fablet and Jer Noble.\n\nA compromised WebContent process can send StartProducingData repeatedly\nfor the same source. After the first call, the source proxy is registered\nas an AudioSampleObserver and the capture unit is invoking\naudioSamplesAvailable() on a background WorkQueue. On subsequent calls,\nprepareAudioDescription() runs on the GPU main thread and reassigns\nm_captureSemaphore, m_ringBuffer, m_audioHandle and m_description without\nremoving the observer or taking any lock, while the capture thread is\nconcurrently dereferencing them. This leads to heap-use-after-free on the\nfreed ProducerSharedCARingBuffer / IPC::Semaphore and write-after-unmap\ninto the old SharedMemory ring buffer.\n\nMake UserMediaCaptureManagerProxySourceProxy::start() a no-op when the\nproxy is already observing media. Legitimate stop()/start() sequences are\nunaffected since stop() removes the observer.\n\nTest: ipc/usermedia-capture-start-producing-data-race.html\n\n* LayoutTests/ipc/usermedia-capture-start-producing-data-race-expected.txt: Added.\n* LayoutTests/ipc/usermedia-capture-start-producing-data-race.html: Added.\n* LayoutTests/platform/glib/TestExpectations:\n* Source/WebKit/GPUProcess/webrtc/UserMediaCaptureManagerProxy.cpp:\n\nOriginally-landed-as: 305413.863@safari-7624-branch (651097467a79). rdar://180438398\nCanonical link: https://commits.webkit.org/316261@main",
      "email": "eric.carlson@apple.com",
      "hash": "866892a3052f6739cffd35175d93b0d238091b29",
      "subject": "[CoreIPC][GPUProcess] UserMediaCaptureManagerProxy::startProducingData races prepareAudioDescription() against audioSamplesAvailable() lead to various UAF/write-after-unmap"
    },
    "316262@main": {
      "author": "Devin Rousso",
      "avatar": "https://www.gravatar.com/avatar/c9e757d973342c773f107a94b70cb9cd?d=identicon\u0026s=64",
      "cl": "316262@main",
      "clUrl": "https://commits.webkit.org/316262@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=296421\n\u003crdar://problem/157178256\u003e\n\nReviewed by Yusuke Suzuki.\n\nAllow a Symbolic Breakpoint for to pause each time `Array` or `new Date` or `Worker` or etc. is invoked, just like any other kind of function call.\n\nUnfortunately, `InternalFunction` does not have any sort of executable so it's not possible to programatically instrument like what's already been done for native methods (specifically `NativeExecutable`)\n\nFurthermore, adding a `willCallNativeConstructor` call to every constructor would be repetitive and have no guarantees of being kept up-to-date as new constructors are added.\n\nAs such, approach this very similar to `NativeExecutable` thunks are currently swapped, except with the underlying native functions instead.\n\n* Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp:\n(JSC::BytecodeGenerator::expectedFunctionForIdentifier):\nPrevent the optimizations for `new Array` and `new Object` when Web Inspector is open.\n\n* Source/JavaScriptCore/runtime/InternalFunction.cpp:\n(JSC::InternalFunction::finishCreation):\n* Source/JavaScriptCore/debugger/Debugger.h:\n(JSC::Debugger::Observer::didCreateInternalFunction): Added.\n(JSC::Debugger::Observer::willCallInternalFunction): Added.\n* Source/JavaScriptCore/debugger/Debugger.cpp:\n(JSC::Debugger::didCreateInternalFunction): Added.\n(JSC::Debugger::willCallInternalFunction): Added.\nNotify Web Inspector whenever a new `InternalFunction` is created so that any existing symbolic breakpoints can match it.\n\n* Source/JavaScriptCore/runtime/InternalFunction.h:\n(JSC::InternalFunction::setNativeFunctionForDebugger): Added.\n* Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.h:\n* Source/JavaScriptCore/inspector/agents/InspectorDebuggerAgent.cpp:\n(Inspector::functionName):\n(Inspector::ReplacedInternalFunction::~ReplacedInternalFunction): Added.\n(Inspector::ReplacedInternalFunction::operator==): Added.\n(Inspector::replacedInternalFunctions): Added.\n(Inspector::internalFunctionWithDebuggerHook): Added.\n(Inspector::internalFunctionCallWithDebuggerHook): Added.\n(Inspector::internalFunctionConstructWithDebuggerHook): Added.\n(Inspector::InspectorDebuggerAgent::addSymbolicBreakpoint):\n(Inspector::InspectorDebuggerAgent::removeSymbolicBreakpoint):\n(Inspector::InspectorDebuggerAgent::didCreateInternalFunction): Added.\n(Inspector::InspectorDebuggerAgent::willCallInternalFunction): Added.\n(Inspector::InspectorDebuggerAgent::clearInspectorBreakpointState):\nAllow swapping the underlying native function with a variant that includes a host call to the debugger.\n\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-exact-case-insensitive.html: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-exact-case-insensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-exact-case-insensitive-expected.txt: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-exact-case-insensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-exact-case-sensitive.html: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-exact-case-sensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-exact-case-sensitive-expected.txt: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-exact-case-insensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-native-dom-exact-case-insensitive.html: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-native-js-regex-case-sensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-native-dom-exact-case-insensitive-expected.txt: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-native-dom-regex-case-insensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-native-dom-exact-case-sensitive.html: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-native-js-exact-case-sensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-native-dom-exact-case-sensitive-expected.txt: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-native-dom-regex-case-insensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-native-dom-regex-case-insensitive.html: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-native-js-regex-case-sensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-native-dom-regex-case-insensitive-expected.txt: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-native-dom-regex-case-insensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-native-dom-regex-case-sensitive.html: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-native-js-regex-case-sensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-native-dom-regex-case-sensitive-expected.txt: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-native-dom-regex-case-insensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-native-js-exact-case-insensitive.html: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-native-js-regex-case-sensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-native-js-exact-case-insensitive-expected.txt: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-native-dom-regex-case-insensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-native-js-exact-case-sensitive.html: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-native-js-exact-case-sensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-native-js-exact-case-sensitive-expected.txt: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-native-dom-regex-case-insensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-native-js-regex-case-insensitive.html: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-native-js-regex-case-sensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-native-js-regex-case-insensitive-expected.txt: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-native-dom-regex-case-insensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-native-js-regex-case-sensitive.html: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-native-js-regex-case-sensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-native-js-regex-case-sensitive-expected.txt: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-native-dom-regex-case-insensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-regex-case-insensitive.html: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-regex-case-insensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-regex-case-insensitive-expected.txt: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-exact-case-insensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-regex-case-sensitive.html: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-regex-case-sensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-construct-regex-case-sensitive-expected.txt: Copied from LayoutTests/inspector/debugger/symbolic-breakpoint-exact-case-insensitive-expected.txt.\nAdd new Symbolic Breakpoint tests (based on existing tests) for constructing with a function.\n\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-exact-case-insensitive.html: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-exact-case-insensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-exact-case-insensitive-expected.txt: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-exact-case-sensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-exact-case-sensitive.html: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-exact-case-sensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-exact-case-sensitive-expected.txt: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-exact-case-insensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-native-dom-exact-case-insensitive.html: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-native-dom-exact-case-insensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-native-dom-exact-case-insensitive-expected.txt: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-native-dom-regex-case-insensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-native-dom-exact-case-sensitive.html: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-native-dom-exact-case-sensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-native-dom-exact-case-sensitive-expected.txt: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-native-dom-regex-case-sensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-native-dom-regex-case-insensitive.html: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-native-dom-regex-case-insensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-native-dom-regex-case-insensitive-expected.txt: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-native-dom-regex-case-insensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-native-dom-regex-case-sensitive.html: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-native-dom-regex-case-sensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-native-dom-regex-case-sensitive-expected.txt: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-native-dom-exact-case-sensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-native-js-exact-case-insensitive.html: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-native-js-exact-case-insensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-native-js-exact-case-insensitive-expected.txt: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-native-dom-regex-case-insensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-native-js-exact-case-sensitive.html: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-native-js-exact-case-sensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-native-js-exact-case-sensitive-expected.txt: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-native-dom-regex-case-insensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-native-js-regex-case-insensitive.html: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-native-js-regex-case-insensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-native-js-regex-case-insensitive-expected.txt: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-native-dom-regex-case-insensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-native-js-regex-case-sensitive.html: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-native-js-regex-case-sensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-native-js-regex-case-sensitive-expected.txt: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-native-dom-exact-case-insensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-regex-case-insensitive.html: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-regex-case-insensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-regex-case-insensitive-expected.txt: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-regex-case-sensitive-expected.txt.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-regex-case-sensitive.html: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-regex-case-sensitive.html.\n* LayoutTests/inspector/debugger/symbolic-breakpoint-call-regex-case-sensitive-expected.txt: Renamed from LayoutTests/inspector/debugger/symbolic-breakpoint-regex-case-insensitive-expected.txt.\nRename existing Symbolic Breakpoint tests to clarify that they only test calling functions (as opposed to constructing with a function).\n\nCanonical link: https://commits.webkit.org/316262@main",
      "email": "hi@devinrousso.com",
      "hash": "377275e3592ad0a15de64b1cc1a7475f3390a689",
      "subject": "Web Inspector: symbolic breakpoints should work with native constructors"
    },
    "316263@main": {
      "author": "Basuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/5192a1151c7575317affb7a4633f8d63?d=identicon\u0026s=64",
      "cl": "316263@main",
      "clUrl": "https://commits.webkit.org/316263@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318236\nrdar://181040211\n\nReviewed by Sihui Liu.\n\nThe \"initial about:blank\" state was represented as a raw bool along the\nDocumentLoader -\u003e HistoryItem -\u003e FrameState pipeline and as a parameter of the\nCross-Origin-Opener-Policy browsing-context-group-switch checks. A raw bool\nthreaded through long parameter and initializer lists is error-prone -- it is\neasy to confuse which true maps to which argument -- as noted in review of\nhttps://bugs.webkit.org/show_bug.cgi?id=317458.\n\nIntroduce WebCore::IsInitialAboutBlank (enum class : bool { No, Yes }) in\nFrameLoaderTypes.h and use it for:\n- DocumentLoader::isInitialAboutBlank() / m_isInitialAboutBlank, the source of\n  truth, set from FrameLoaderStateMachine::isDisplayingInitialEmptyDocument().\n- HistoryItem::isInitialAboutBlank() / setIsInitialAboutBlank().\n- FrameState::isInitialAboutBlank (SessionState), its IPC serialization, and the\n  SessionStateConversion round-trip.\n- coopValuesRequireBrowsingContextGroupSwitch() and the report-only variant in\n  CrossOriginOpenerPolicy.\n\nThe sibling UI-process concept WebFrameProxy::isShowingInitialAboutBlank (carried\nby the DecidePolicyForResponse IPC) and FrameLoaderStateMachine's\nisDisplayingInitialEmptyDocument() remain plain bools; they are converted to the\nenum at the call boundaries that feed the COOP checks. This is a type-safety\nrefactor with no behavior change.\n\n* Source/WebCore/history/HistoryItem.h:\n(WebCore::HistoryItem::setIsInitialAboutBlank):\n(WebCore::HistoryItem::isInitialAboutBlank const):\n* Source/WebCore/loader/CrossOriginOpenerPolicy.cpp:\n(WebCore::coopValuesRequireBrowsingContextGroupSwitch):\n(WebCore::checkIfEnforcingReportOnlyCOOPWouldRequireBrowsingContextGroupSwitch):\n(WebCore::enforceResponseCrossOriginOpenerPolicy):\n* Source/WebCore/loader/CrossOriginOpenerPolicy.h:\n* Source/WebCore/loader/DocumentLoader.cpp:\n(WebCore::DocumentLoader::maybeLoadEmpty):\n* Source/WebCore/loader/DocumentLoader.h:\n(WebCore::DocumentLoader::isInitialAboutBlank const):\n* Source/WebCore/loader/FrameLoader.cpp:\n(WebCore::FrameLoader::updateURLAndHistory):\n(WebCore::FrameLoader::loadURL):\n* Source/WebCore/loader/FrameLoaderTypes.h:\n* Source/WebCore/page/Navigation.cpp:\n(WebCore::Navigation::hasEntriesAndEventsDisabled const):\n* Source/WebCore/rendering/RenderView.cpp:\n(WebCore::RenderView::shouldPaintBaseBackground const):\n* Source/WebKit/Shared/SessionState.cpp:\n(WebKit::FrameState::FrameState):\n* Source/WebKit/Shared/SessionState.h:\n* Source/WebKit/Shared/SessionState.serialization.in:\n* Source/WebKit/Shared/WebCoreArgumentCoders.serialization.in:\n* Source/WebKit/UIProcess/WebPageProxy.cpp:\n(WebKit::isStaleInitialAboutBlankIframeTarget):\n(WebKit::WebPageProxy::decidePolicyForResponseShared):\n\nCanonical link: https://commits.webkit.org/316263@main",
      "email": "basuke@apple.com",
      "hash": "0c07de9d969fa9ffcf321d36bcda33afda5afec3",
      "subject": "Replace isInitialAboutBlank bool with an enum class : bool"
    },
    "316264@main": {
      "author": "Jonathan Bedard",
      "avatar": "https://www.gravatar.com/avatar/24548a6c84377efe7594acc92601e839?d=identicon\u0026s=64",
      "cl": "316264@main",
      "clUrl": "https://commits.webkit.org/316264@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318335\nrdar://181117538\n\nUnreviewed build fix.\n\n* Source/WebKit/Shared/AuxiliaryProcess.h:\n\nCanonical link: https://commits.webkit.org/316264@main",
      "email": "jbedard@apple.com",
      "hash": "e6ae228035528377f7543b636fa79bb1c64ac988",
      "subject": "REGRESSION(316251@main): Builds are failing with Out-of-line definition of 'getHomeDirectory' does not match any declaration in '... and 1 other errors"
    },
    "316265@main": {
      "author": "Antti Koivisto",
      "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64",
      "cl": "316265@main",
      "clUrl": "https://commits.webkit.org/316265@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318332\nrdar://181118666\n\nReviewed by Alan Baradlay.\n\nComma-containing values can be used in arguments using braces like --f({1px,2px}).\n\nhttps://drafts.csswg.org/css-values-5/#component-function-commas\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/dashed-function-eval-expected.txt:\n* Source/WebCore/style/StyleSubstitutionResolver.cpp:\n(WebCore::Style::unwrapArgumentBraces):\n\nAdd a helper.\n\n(WebCore::Style::SubstitutionResolver::substituteDashedFunction):\n(WebCore::Style::SubstitutionResolver::substituteInternalAutoBaseFunction):\n\nAlso use for -internal-auto-base which already had unwrap code.\n\nCanonical link: https://commits.webkit.org/316265@main",
      "email": "antti@apple.com",
      "hash": "95091b3ea725d9c6caaee71f76221bc36a6e26b6",
      "subject": "[css-mixins-1] Unwrap braces in function arguments"
    },
    "316266@main": {
      "author": "Anand Srinivasan",
      "avatar": "https://www.gravatar.com/avatar/84643a20c269974c2df6681742daf0a4?d=identicon\u0026s=64",
      "cl": "316266@main",
      "clUrl": "https://commits.webkit.org/316266@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315223\nrdar://176190526\n\nReviewed by Dan Hecht.\n\nIn br_on_cast and br_on_cast_fail flag bits other than 0 and 1 are\nreserved. The validator currently does not check that reserved bits are\n0 and IPInt assumes reserved bits are 0. This patch makes the validator\ncheck the reserved bits.\n\nTest: JSTests/wasm/stress/br-on-cast-reserved-flags.js\n\n* JSTests/wasm/stress/br-on-cast-reserved-flags.js: Added.\n* Source/JavaScriptCore/wasm/WasmFunctionParser.h:\n(JSC::Wasm::FunctionParser\u003cContext\u003e::parseExpression):\n(JSC::Wasm::FunctionParser\u003cContext\u003e::parseUnreachableExpression):\n\nOriginally-landed-as: 305413.945@safari-7624-branch (6d5ae0fc9aa1). rdar://180437388\nCanonical link: https://commits.webkit.org/316266@main",
      "email": "anand_srinivasan@apple.com",
      "hash": "5df8b0b81bf5a7ca7513fb5b61fcaf64e936dae0",
      "subject": "WasmGC should reject reserved bits in br_on_cast/br_on_cast_fail flags byte"
    },
    "316267@main": {
      "author": "Said Abou-Hallawa",
      "avatar": "https://www.gravatar.com/avatar/ae80a929a378a055822829ae63903296?d=identicon\u0026s=64",
      "cl": "316267@main",
      "clUrl": "https://commits.webkit.org/316267@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314268\nrdar://175674532\n\nReviewed by Simon Fraser.\n\nIn https://commits.webkit.org/305413.516@safari-7624-branch, ParallelJobs are\nused to apply the FEMorphology filter. Applying the filter in parallel happens\nin two steps:\n\n1. Split the destination pixel buffer into `jobs` horizontal strips and then\n   dispatches them in parallel\n2. When all the parallel jobs finish, the scratch outputs are stitched back via\n   a gather loop.\n\nThe first job is done directly into the destination PixelBuffer. So no stitching\nis needed for job_0. Stitching the rest of the jobs (job_1 .. job_{n-1}) requires\nmoving the y-position in destination PixelBuffer by the height of the previous\njob. And it requires also calculating the height of the current job. The problem\nis the height of the current job is used to move y-position. This may prevent\nstitching the last line in the last job to the destination PixelBuffer.\n\n* Source/WebCore/platform/graphics/filters/software/FilterEffectSoftwareParallelApplier.h:\n(WebCore::applyPlatformParallel):\n\nOriginally-landed-as: 305413.865@safari-7624-branch (5d5fdc06de11). rdar://180437652\nCanonical link: https://commits.webkit.org/316267@main",
      "email": "said@apple.com",
      "hash": "d97d1afd0b8bd640d288c83dc501ee4e2e6c1421",
      "subject": "REGRESSION(305413.516@safari-7624-branch): The height of the FEMorphology filter might be off by 1"
    },
    "316268@main": {
      "author": "Per Arne Vollan",
      "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64",
      "cl": "316268@main",
      "clUrl": "https://commits.webkit.org/316268@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314102\nrdar://174670360\n\nReviewed by Chris Dumez.\n\nCurrently, the local file request is only checked for the first load, but it should always be checked.\n\n* Source/WebKit/NetworkProcess/NetworkResourceLoader.cpp:\n(WebKit::NetworkResourceLoader::startNetworkLoad):\n\nOriginally-landed-as: 305413.840@safari-7624-branch (9cdeb32dccda). rdar://180437685\nCanonical link: https://commits.webkit.org/316268@main",
      "email": "pvollan@apple.com",
      "hash": "ec611dac5b6621494491ba3cb9ff1f937de10bef",
      "subject": "Local file loads should always be checked in NetworkResourceLoader::startNetworkLoad"
    },
    "316269@main": {
      "author": "Per Arne Vollan",
      "avatar": "https://www.gravatar.com/avatar/644dde5b61925a175f4bdea3f0f00bda?d=identicon\u0026s=64",
      "cl": "316269@main",
      "clUrl": "https://commits.webkit.org/316269@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318329\nrdar://181117211\n\nReviewed by Taher Ali and Basuke Suzuki.\n\nAdd new files to SourcesCocoa.txt instead of adding target membership in Xcode.\n\n* Source/WebKit/SourcesCocoa.txt:\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n\nCanonical link: https://commits.webkit.org/316269@main",
      "email": "pvollan@apple.com",
      "hash": "e97c47b193bcbac8498a64943596c8ab2261adea",
      "subject": "Fix CMake build after 316251@main"
    },
    "316270@main": {
      "author": "Mike Wyrzykowski",
      "avatar": "https://www.gravatar.com/avatar/4b1bc9e238714f95e22d5d2454c07066?d=identicon\u0026s=64",
      "cl": "316270@main",
      "clUrl": "https://commits.webkit.org/316270@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313551\nrdar://174670066\n\nReviewed by Tadeu Zagallo.\n\nFrom the JS layer it is impossible to reach a negative\nmapped buffer count because the web content process will\nreject unmapping a buffer which is not mapped.\n\nBut a compromised process capable of sending IPC messages directly\nto the GPU process can achieve that.\n\nPrevent that by ensuring the map buffer count is never negative\nas it would allow a currently mapped buffer to be modified\nwhile the GPU is simultaneously writing to it.\n\n* Source/WebGPU/WebGPU/CommandEncoder.mm:\n(WebGPU::CommandEncoder::decrementBufferMapCount):\n* Source/WebKit/GPUProcess/graphics/WebGPU/RemoteBuffer.cpp:\n(WebKit::RemoteBuffer::getMappedRange):\n\nOriginally-landed-as: 305413.753@safari-7624-branch (7941fb9f0d02). rdar://180437592\nCanonical link: https://commits.webkit.org/316270@main",
      "email": "mwyrzykowski@apple.com",
      "hash": "ce589a4f52d7f6ff196f12d2eedd456e085bbf0d",
      "subject": "m_bufferMapCount via getMappedRange State Confusion Leads to GPU OOB"
    },
    "316271@main": {
      "author": "Wenson Hsieh",
      "avatar": "https://www.gravatar.com/avatar/c8fba82556fd4988c78bd3a0aee2a44e?d=identicon\u0026s=64",
      "cl": "316271@main",
      "clUrl": "https://commits.webkit.org/316271@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318263\nrdar://180970146\n\nReviewed by Richard Robinson and Abrar Rahman Protyasha.\n\nInvoke `-textInputClientDidUpdateSelection` after scrolling or zooming on macOS to update the Siri\nWriting Tools affordance position and visibility. To do this, leverage the existing\n`m_contentRelativeViewsHysteresis` activity timer and keep track of a new flag\n(`m_contentRelativeViewsNeedToBeRepositioned`) that schedules an update on the `NSTextInputClient`\nwhen reset, after scrolling/zooming ends.\n\nTest: EditorStateTests.NotifyTextInputClientAfterMagnificationChange\n\n* Source/WebKit/UIProcess/mac/WebViewImpl.h:\n* Source/WebKit/UIProcess/mac/WebViewImpl.mm:\n(WebKit::WebViewImpl::handleProcessSwapOrExit):\n(WebKit::WebViewImpl::suppressContentRelativeChildViews):\n(WebKit::WebViewImpl::contentRelativeViewsHysteresisTimerFired):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/EditorStateTests.mm:\n(TestWebKitAPI::TEST(EditorStateTests, NotifyTextInputClientAfterMagnificationChange)):\n\nCanonical link: https://commits.webkit.org/316271@main",
      "email": "wenson_hsieh@apple.com",
      "hash": "7b38a3e97b1b1559fa0f526c8661c609e2078286",
      "subject": "[Writing Tools] Siri affordance appears after selecting and hovering text, but remains in the wrong place after you scroll the page"
    },
    "316272@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316272@main",
      "clUrl": "https://commits.webkit.org/316272@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313623\nrdar://175673154\n\nReviewed by Ryosuke Niwa.\n\nIterate over a copy of the HistoryItem children vector since it can be\nmodified while looping.\n\nTest: fast/history/popstate-add-iframes-during-history-back.html\n\n* LayoutTests/fast/history/popstate-add-iframes-during-history-back-expected.txt: Added.\n* LayoutTests/fast/history/popstate-add-iframes-during-history-back.html: Added.\n* Source/WebCore/loader/HistoryController.cpp:\n(WebCore::HistoryController::recursiveSetProvisionalItem):\n(WebCore::HistoryController::recursiveGoToItem):\n\nOriginally-landed-as: 305413.764@safari-7624-branch (9fd7e69ed2c4). rdar://180437593\nCanonical link: https://commits.webkit.org/316272@main",
      "email": "cdumez@apple.com",
      "hash": "efe49205d32cdfd396ca62f1b3b7452acdcfc176",
      "subject": "Use-after-free in HistoryController::recursiveGoToItem — popstate-reentrant setChildItem reallocates iterated m_children"
    },
    "316273@main": {
      "author": "Matthew Finkel",
      "avatar": "https://www.gravatar.com/avatar/656f8950aefb56f553c899418e06b351?d=identicon\u0026s=64",
      "cl": "316273@main",
      "clUrl": "https://commits.webkit.org/316273@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315306\nrdar://176234578\n\nReviewed by Charlie Wolfe.\n\nThe current behavior may skip setting _setAllowOnlyPartitionedCookies because\nmutableRequest may be nil in some cases. We fix this by accessing the request\nwith ensureMutableRequest, instead.\n\nCovered by WKHTTPCookieStore.WebSocketCookies2 API test.\n\n* Source/WebKit/NetworkProcess/cocoa/NetworkSessionCocoa.mm:\n(WebKit::NetworkSessionCocoa::createWebSocketTask):\n* Tools/TestWebKitAPI/Tests/WebKitCocoa/WKHTTPCookieStore.mm:\n(TEST(WKHTTPCookieStore, WebSocketCookies)):\n(TEST(WKHTTPCookieStore, WebSocketCookies2)):\n\nOriginally-landed-as: 305413.953@safari-7624-branch (6faafed9cbd3). rdar://180436267\nCanonical link: https://commits.webkit.org/316273@main",
      "email": "m_finkel@apple.com",
      "hash": "971435fdd3868e7fe45ec6ce8386e93766de1266",
      "subject": "[cocoa] _setAllowOnlyPartitionedCookies may not be set on WebSocket requests"
    },
    "316274@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "316274@main",
      "clUrl": "https://commits.webkit.org/316274@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313703\nrdar://175673135\n\nReviewed by Wenson Hsieh and Chris Dumez.\n\nFixed the bug by deploying more smart pointers.\n\nTest: fast/dom/trusted-types-iframe-removal-crash.html\n\n* LayoutTests/fast/dom/trusted-types-iframe-removal-crash-expected.txt: Added.\n* LayoutTests/fast/dom/trusted-types-iframe-removal-crash.html: Added.\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::parseHTMLUnsafe):\n(WebCore::Document::write):\n(WebCore::Document::execCommand):\n* Source/WebCore/dom/Element.cpp:\n(WebCore::Element::setHTMLUnsafe):\n(WebCore::Element::setOuterHTML):\n(WebCore::Element::setInnerHTML):\n(WebCore::Element::insertAdjacentHTML):\n* Source/WebCore/dom/Range.cpp:\n(WebCore::Range::createContextualFragment):\n* Source/WebCore/dom/ShadowRoot.cpp:\n(WebCore::ShadowRoot::setHTMLUnsafe):\n(WebCore::ShadowRoot::setInnerHTML):\n\nOriginally-landed-as: 305413.805@safari-7624-branch (64d15c23216d). rdar://180437947\nCanonical link: https://commits.webkit.org/316274@main",
      "email": "rniwa@webkit.org",
      "hash": "cb83583e5f4d955355574006a1bebf4b98a42a5d",
      "subject": "Use-after-free of Document in trustedTypeCompliantString"
    },
    "316275@main": {
      "author": "Marcus Plutowski",
      "avatar": "https://www.gravatar.com/avatar/0dc4fa1c337348e333de44505752edb8?d=identicon\u0026s=64",
      "cl": "316275@main",
      "clUrl": "https://commits.webkit.org/316275@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314829\nrdar://175683224\n\nReviewed by Dan Hecht and Yijia Huang.\n\nThe medium-size directory is protected by both the heap-lock and a\nseqlock (i.e. pas_mutation_count on rare_data-\u003emutation_count).\nThe seqlock allows for readers to access the rare_data without\nacquiring a lock; if the mutation-count shows that the object is being\nmutated, then the reader is supposed to fall-back to acquiring the\nheap-lock. However, as an optimization, if the heap-lock is already\nheld, the reader skips the seqlock step.\nPreviously, pas_segregated_heap_size_directory_for_index_slow would\nalways call pas_segregated_heap_medium_size_directory_for_index with\npas_lock_is_held. This meant that in certain cases, slow-path calls\nwill hit a race that results in a malloc call being given a slot within\nsegregated-heap slot that is actually too small for the requested size.\n\nOperationally, what would happen is more or less\n  1. ThreadA tries allocating an object X and searches for a\n     matching medium-size-directory, but fails to find one.\n  2. This means it needs to create a new medium-size-directory.\n     This requires inserting a new entry into the medium-tuple array.\n     ThreadA determines that the new tuple should live at index M.\n  3. The medium-tuple array is sorted and packed, so inserting into the\n     middle requires `memmove`'ing all tuples down one slot --\n     so ThreadA does so.\n     At this point, slot[M] still points to the old entry,\n     and still has the old begin/end.\n  3. ThreadA then begins overwriting the slot[M], first\n     overwriting the directory-pointer.\n     At this point, slot[M] still has the old begin/end,\n     but points to the new directory.\n  4. ThreadB tries allocating an object Y. It should take the seqlock\n     here, but incorrectly assumes that it holds the heap-lock and thus\n     doesn't need to.\n  5. ThreadB searches for a matching medium-size-directory, and finds\n     slot[M] has a begin/end pair that matches its expectations.\n  6. ThreadB then reads slot[M]'s directory pointer, thus\n     getting a directory with a mismatched size.\n  7. ThreadB then asks that directory for an allocation-slot,\n     and gets one back: however, the size of this slot is\n     necessarily too small (because of the sorted-insertion\n     requirement in #3 above).\n     Therefore, the caller thinks that it got e.g. an 8192B\n     slot but in fact only got a 7162B slot. A write to the\n     latter bytes of the slot will corrupt the memory of the\n     subsequent allocation.\nN.b. step #3 is also a race on its own, but it's harder to capture\nsince we can't hook in the middle of the memmove.\n\nBest as I can tell, at some point this hardcoded heap-lock hold mode\nwas actually correct, since the primary path to get here does acquire\nthe lock. However, there's another path (perhaps added later?\nunfortunately it's all lumped into the commit that added libpas to the\nrepo) that doesn't do so. So the correct fix is to pipe the heap-lock\nhold status up far enough that we either get to a function that takes\nthe hold-mode as a parameter, or one which asserts that the heap-lock\nis held.\n\n* Source/bmalloc/libpas/src/libpas/test/RaceTests.cpp: added\n  new test to exhibit the race described above.\n\nOriginally-landed-as: 305413.966@safari-7624-branch (58ebed1e9cec). rdar://180436276\nCanonical link: https://commits.webkit.org/316275@main",
      "email": "marcus_plutowski@apple.com",
      "hash": "82b692fc69fc58e128e35db1a2d0d5e5ae3bbec5",
      "subject": "[libpas] Fix race in pas_segregated_heap_medium_size_directory_for_index"
    },
    "316276@main": {
      "author": "Mike Wyrzykowski",
      "avatar": "https://www.gravatar.com/avatar/4b1bc9e238714f95e22d5d2454c07066?d=identicon\u0026s=64",
      "cl": "316276@main",
      "clUrl": "https://commits.webkit.org/316276@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313368\nrdar://174662876\n\nReviewed by Dan Glastonbury.\n\nCorrect wrapping logic while supporting wrap to zero for\ntriangle + line restart indices.\n\n* Source/WebGPU/WebGPU/Device.mm:\n(WebGPU::Device::indexBufferClampPipeline):\n\nOriginally-landed-as: 305413.811@safari-7624-branch (a69633739677). rdar://180436268\nCanonical link: https://commits.webkit.org/316276@main",
      "email": "mwyrzykowski@apple.com",
      "hash": "0077500fa5bef9cbd92f0060aed5ec59fde533de",
      "subject": "uint32 Wraparound in vsUintIndexClamp Leads to GPU OOB Read"
    },
    "316277@main": {
      "author": "Kai Tamkun",
      "avatar": "https://www.gravatar.com/avatar/dff073cba21885df4d9f73ed3cc493c2?d=identicon\u0026s=64",
      "cl": "316277@main",
      "clUrl": "https://commits.webkit.org/316277@main",
      "description": "rdar://175683200\nhttps://bugs.webkit.org/show_bug.cgi?id=314679\n\nReviewed by Yusuke Suzuki.\n\nThis patch changes `bmalloc_try_allocate_zeroed_inline` so that it\nzeroes the returned memory in the case where the MAR predicate matches.\n\nTests: Tools/TestWebKitAPI/Tests/WTF/bmalloc/MAR.cpp\n\n* Source/bmalloc/libpas/src/libpas/bmalloc_heap_inlines.h:\n(bmalloc_try_allocate_zeroed_inline): Zero the returned memory.\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WTF/bmalloc/MAR.cpp: Added.\n(TestWebKitAPI::pageIndexOf):\n(TestWebKitAPI::testZeroedAllocationAfterPriming):\n(TestWebKitAPI::TEST(bmalloc, MARZeroedAllocationWithMARDisabled)):\n(TestWebKitAPI::TEST(bmalloc, MARZeroedAllocationWithMAREnabled)):\n\nOriginally-landed-as: 305413.946@safari-7624-branch (d945beacb08e). rdar://180428128\nCanonical link: https://commits.webkit.org/316277@main",
      "email": "k_tamkun@apple.com",
      "hash": "dce31d0f206f8608085256c0ef15e337ce4a1710",
      "subject": "[libpas] bmalloc_try_allocate_zeroed_inline calls PAS_MAR_TRACK_ALLOCATION instead of PAS_MAR_TRACK_ALLOCATION_AND_ZERO on MAR branch, returning unzeroed memory"
    },
    "316278@main": {
      "author": "Ryosuke Niwa",
      "avatar": "https://www.gravatar.com/avatar/ed2c71248fe3ea15d9129f6e9a2a1e85?d=identicon\u0026s=64",
      "cl": "316278@main",
      "clUrl": "https://commits.webkit.org/316278@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313691\nrdar://174651164\n\nReviewed by Wenson Hsieh.\n\nAvoid the use-after-free by moving the contents of Vector to a local variable.\n\nTest: editing/async-clipboard/clipboard-write-item-crash.html\n\n* LayoutTests/editing/async-clipboard/clipboard-write-item-crash-expected.txt: Added.\n* LayoutTests/editing/async-clipboard/clipboard-write-item-crash.html: Added.\n* Source/WebCore/Modules/async-clipboard/ClipboardItemBindingsDataSource.cpp:\n(WebCore::ClipboardItemBindingsDataSource::clearItemTypeLoaders):\n\nOriginally-landed-as: 305413.812@safari-7624-branch (061b1c5b4012). rdar://180437605\nCanonical link: https://commits.webkit.org/316278@main",
      "email": "rniwa@webkit.org",
      "hash": "c5036aadbde48318a52ffe639cb603aaeea8cce7",
      "subject": "Heap use-after-free in ClipboardItemBindingsDataSource::clearItemTypeLoaders()"
    },
    "316279@main": {
      "author": "Jer Noble",
      "avatar": "https://www.gravatar.com/avatar/6d2cde9be23b98223ca964cb3b7813a0?d=identicon\u0026s=64",
      "cl": "316279@main",
      "clUrl": "https://commits.webkit.org/316279@main",
      "description": "rdar://179497684\nhttps://bugs.webkit.org/show_bug.cgi?id=318235\n\nReviewed by Eric Carlson.\n\nManagedMediaSource uses a timer to ensure it releases its MediaStreaming state after a timeout, should the\npage not adequately buffer during the streaming period. If the process is suspended while this timer is active\nthe timer will never fire, and networking will be pinned in the MediaStreaming state.\n\nAdd a condition to WebProcessProxy::updateMediaStreamingActivity() which will release the MediaStreaming state\nwhen the WebContent process is suspended.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/MediaStreamingActivitySuspended.mm\n\n* Source/WebKit/UIProcess/AuxiliaryProcessProxy.h:\n(WebKit::AuxiliaryProcessProxy::isSuspended const):\n* Source/WebKit/UIProcess/WebProcessProxy.cpp:\n(WebKit::WebProcessProxy::didChangeThrottleState):\n(WebKit::WebProcessProxy::updateMediaStreamingActivity):\n* Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/MediaStreamingActivitySuspended.mm: Added.\n(TestWebKitAPI::TEST(WebKit, ManagedMSEMediaStreamingActivityClearedOnProcessSuspend)):\n(TestWebKitAPI::TEST(WebKit, ManagedMSEMediaStreamingActivityClearedOnProcessCrash)):\n\nCanonical link: https://commits.webkit.org/316279@main",
      "email": "jer.noble@apple.com",
      "hash": "9d2c43b4dc9d9c47448c510c87e79ecaf40b60a4",
      "subject": "[iOS] Networking can get pinned in a MediaStreaming state if the WebContent process is suspended with MediaStreaming active"
    },
    "316280@main": {
      "author": "Antti Koivisto",
      "avatar": "https://www.gravatar.com/avatar/07965eed55d4b41ea2b394599b17f7cd?d=identicon\u0026s=64",
      "cl": "316280@main",
      "clUrl": "https://commits.webkit.org/316280@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318327\nrdar://181114298\n\nReviewed by Alan Baradlay.\n\nhttps://drafts.csswg.org/css-variables-2/#replace-a-var-function\n\n    4. If result contains the guaranteed-invalid value, and second arg was provided, set result\n    to the result of substitute arbitrary substitution functions on second arg.\n\nFallback resolution used to be eager but it was changed in https://github.com/w3c/csswg-drafts/issues/11500.\n\nAlso remove LayoutTests/css-custom-properties-api, old Chromium register-property imports\nsuperseded by the imported css/css-properties-values-api web-platform-tests. One of them\nasserted the pre-short-circuit fallback behavior.\n\n* LayoutTests/css-custom-properties-api/: Removed.\n* LayoutTests/platform/glib/TestExpectations:\n* LayoutTests/platform/mac-wk1/TestExpectations:\n* LayoutTests/platform/visionos/TestExpectations:\n* LayoutTests/platform/win/TestExpectations:\n\nRemove entries for the deleted directory.\n\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/dashed-function-cycles-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-mixins/local-attr-substitution-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-properties-values-api/var-reference-registered-properties-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-cycles-expected.txt:\n* LayoutTests/imported/w3c/web-platform-tests/css/css-variables/variable-substitution-variable-declaration-expected.txt:\n* Source/WebCore/style/StyleSubstitutionResolver.cpp:\n(WebCore::Style::SubstitutionResolver::substituteVariableFunction):\n(WebCore::Style::SubstitutionResolver::substituteVariableFallback): Deleted.\n* Source/WebCore/style/StyleSubstitutionResolver.h:\n\nCanonical link: https://commits.webkit.org/316280@main",
      "email": "antti@apple.com",
      "hash": "927ccd52454a4e15c09f9930878cbbb6ad51bc23",
      "subject": "Resolve var() fallback only when the first arg resolves invalid"
    },
    "316281@main": {
      "author": "Timothy Hatcher",
      "avatar": "https://www.gravatar.com/avatar/d0f8f949749d89ed152fa835ede38c5b?d=identicon\u0026s=64",
      "cl": "316281@main",
      "clUrl": "https://commits.webkit.org/316281@main",
      "description": "https://webkit.org/b/314567\nrdar://176483583\n\nReviewed by Kiara Rose.\n\nARC zero-initialized statics don't get a compiler-generated thread-safety guard, so concurrent\ndeclarativeNetRequest rule compilation could retain a freed array in the UI Process.\n\n* Source/WebKit/UIProcess/Extensions/Cocoa/_WKWebExtensionDeclarativeNetRequestRule.mm:\n(-[_WKWebExtensionDeclarativeNetRequestRule _resourcesToTargetWhenNoneAreSpecifiedInRule]): Use dispatch_once.\n\nOriginally-landed-as: 305413.888@safari-7624-branch (2f23765bb37e). rdar://180438464\nCanonical link: https://commits.webkit.org/316281@main",
      "email": "timothy@apple.com",
      "hash": "ea3fbf953c9b67c34da24a74cfd5331221a1beb1",
      "subject": "Use-after-free in -[_WKWebExtensionDeclarativeNetRequestRule _resourcesToTargetWhenNoneAreSpecifiedInRule] on concurrent queue."
    },
    "316282@main": {
      "author": "Alejandro G. Castro",
      "avatar": "https://www.gravatar.com/avatar/c8c6e17acbdf0549b05d6f7fc2c1c4dc?d=identicon\u0026s=64",
      "cl": "316282@main",
      "clUrl": "https://commits.webkit.org/316282@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318347\n\nUnreviewed gardening.\n\n* LayoutTests/platform/gtk/TestExpectations:\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/316282@main",
      "email": "alex@igalia.com",
      "hash": "c2a3aed89ef0682c288beae530f95b21df3ee1f5",
      "subject": "[GTK][WPE] Tests gardening"
    },
    "316283@main": {
      "author": "Kiara Rose",
      "avatar": "https://www.gravatar.com/avatar/cbfa3709de8e533bdc6505c6c4e83e24?d=identicon\u0026s=64",
      "cl": "316283@main",
      "clUrl": "https://commits.webkit.org/316283@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312319\nrdar://174530074\n\nReviewed by Timothy Hatcher.\n\nWebExtensionRegisteredScriptsSQLiteStore::addScripts and WebExtensionDeclarativeNetRequestSQLiteStore::addRules\nboth captured Ref\u003cJSON::Value\u003e into lambdas dispatched to a background WorkQueue, while the main\nthread still held live references to the same objects. Concurrent increments and decrements from the\ntwo threads cause a lost update on the m_refCount. When the object is freed prematurely on the main\nthread, the WorkQueue is left holding with a dangling reference, causing a heap-use-after-free on\nthe WorkQueue.\n\nFix this by serializing the data before dispatching it to the WorkQueue.\n\n* Source/WebKit/Shared/Extensions/WebExtensionRegisteredScriptsSQLiteStore.cpp:\n(WebKit::WebExtensionRegisteredScriptsSQLiteStore::addScripts):\n(WebKit::WebExtensionRegisteredScriptsSQLiteStore::insertScript):\n* Source/WebKit/Shared/Extensions/WebExtensionRegisteredScriptsSQLiteStore.h:\n* Source/WebKit/UIProcess/Extensions/WebExtensionDeclarativeNetRequestSQLiteStore.cpp:\n(WebKit::WebExtensionDeclarativeNetRequestSQLiteStore::addRules):\n(WebKit::WebExtensionDeclarativeNetRequestSQLiteStore::insertRule):\n* Source/WebKit/UIProcess/Extensions/WebExtensionDeclarativeNetRequestSQLiteStore.h:\n\nOriginally-landed-as: 305413.675@safari-7624-branch (c85584f296ce). rdar://180438305\nCanonical link: https://commits.webkit.org/316283@main",
      "email": "kiara_rose@apple.com",
      "hash": "6d6ea48e7ecfbfa18bfc0ae082227fbae7198d57",
      "subject": "heap-use-after-free in WebExtensionRegisteredScriptsSQLiteStore::addScripts"
    },
    "316284@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "316284@main",
      "clUrl": "https://commits.webkit.org/316284@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318241\nrdar://problem/181047884\n\nReviewed by Alan Baradlay.\n\nWe were not always respecting the min/max size of a grid item because it\nwas mixed into the logic that computing the preferred size. We can fix\nthis instead by moving this logic into their own dedicated functions and\nthen use them to restrict the preferred size according to these values\nonce everything has been computed.\n\nRenaming these functions should also make it much more clear about what\nis being computed.\n\nThe \"used\" size functions now just compute the preferred size (i.e.\nwidth/height properties) and the minimum and maximum size computations\nare in their own dedicated functions.\n\nThe used size functions now just call into the three sets of functions\nfor the axis and then return the preferred size constrained by the min\nand max sizes. It should hopefully now be much clearer what the used\nsize functions compute given how short they are and the newly named\nfunctions they call into.\n\nCanonical link: https://commits.webkit.org/316284@main",
      "email": "sammy.gill@apple.com",
      "hash": "d59a367e9307051c90ad8dbccbaa8532ceeb1df1",
      "subject": "[GFC] Min sizes are not always respected."
    },
    "316285@main": {
      "author": "Alejandro G. Castro",
      "avatar": "https://www.gravatar.com/avatar/c8c6e17acbdf0549b05d6f7fc2c1c4dc?d=identicon\u0026s=64",
      "cl": "316285@main",
      "clUrl": "https://commits.webkit.org/316285@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318351\n\nUnreviewed gardening.\n\n* LayoutTests/platform/wpe/TestExpectations:\n\nCanonical link: https://commits.webkit.org/316285@main",
      "email": "alex@igalia.com",
      "hash": "f9722ade202ffc55993f32866b0b9799cadd459d",
      "subject": "[WPE][arm64] Gardening of tests"
    },
    "316286@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "316286@main",
      "clUrl": "https://commits.webkit.org/316286@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318048\n\u003crdar://problem/181125416\u003e\n\nReviewed by Antti Koivisto.\n\nm_frameRect and its frameRect()/setFrameRect() accessors hold the border box\npositioned in the container's coordinate space, but \"frame\" was vague and collided\nwith Frame/LocalFrame. Rename them to m_borderBoxRectInContainer /\nborderBoxRectInContainer() / setBorderBoxRectInContainer(), naming the thing for what\nit is and pairing directly with the existing borderBoxRect() (the same rect in the\nrenderer's own coordinates, { 0, 0, size }) -- the only difference is the coordinate\nspace. \"container\" matches RenderBox.h's own description of the location (\"relative to\nyour container\") and the mapLocalToContainer/offsetFromContainer vocabulary.\n\nAlso fixes the stale \"frame rect\" comments left behind and renames the flex\nrepaint-snapshot helpers (ChildFrameRects/FlexItemFrameRects and their append*\nfunctions) to ...BorderBoxRects to match. No behavior change.\n\n* Source/WebCore/accessibility/AccessibilityRenderObject.cpp:\n(AccessibilityRenderObject::localRect):\n* Source/WebCore/inspector/InspectorOverlay.cpp:\n(InspectorOverlay::buildFlexOverlay):\n* Source/WebCore/layout/Verification.cpp:\n(outputMismatchingBlockBoxInformationIfNeeded):\n* Source/WebCore/layout/integration/inline/LayoutIntegrationLineLayout.cpp:\n(LineLayout::updateRenderTreePositions):\n* Source/WebCore/page/LocalFrameView.cpp:\n(LocalFrameView::visibleRectOfChild):\n* Source/WebCore/rendering/RenderBlockFlow.cpp:\n(RenderBlockFlow::layoutBlockChild):\n(RenderBlockFlow::positionNewFloats):\n* Source/WebCore/rendering/RenderBox.cpp:\n(RenderBox::repaintDuringLayoutIfMoved):\n* Source/WebCore/rendering/RenderBox.h:\n* Source/WebCore/rendering/RenderBoxInlines.h:\n(RenderBox::logicalSize):\n* Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp:\n(appendChildBorderBoxRects):\n(repaintChildrenDuringLayoutIfMoved):\n(RenderDeprecatedFlexibleBox::layoutBlock):\n* Source/WebCore/rendering/RenderElement.cpp:\n(RenderElement::getTrailingCorner):\n* Source/WebCore/rendering/RenderFlexibleBox.cpp:\n(RenderFlexibleBox::appendFlexItemBorderBoxRects):\n(RenderFlexibleBox::repaintFlexItemsDuringLayoutIfMoved):\n(RenderFlexibleBox::layoutBlock):\n* Source/WebCore/rendering/RenderFlexibleBox.h:\n* Source/WebCore/rendering/RenderGrid.cpp:\n(RenderGrid::layoutGridItems):\n* Source/WebCore/rendering/RenderLayer.cpp:\n(computeLayerPositionAndIntegralSize):\n* Source/WebCore/rendering/RenderLayerBacking.cpp:\n(RenderLayerBacking::RenderLayerBacking):\n* Source/WebCore/rendering/RenderLayerScrollableArea.cpp:\n(RenderLayerScrollableArea::positionOverflowControls):\n* Source/WebCore/rendering/RenderLayoutState.h:\n* Source/WebCore/rendering/RenderMeter.cpp:\n(RenderMeter::updateLogicalWidth):\n(RenderMeter::computeLogicalHeight):\n* Source/WebCore/rendering/RenderMultiColumnSet.cpp:\n(RenderMultiColumnSet::collectLayerFragments):\n* Source/WebCore/rendering/RenderObject.cpp:\n(RenderObject::outputRenderObject):\n* Source/WebCore/rendering/RenderProgress.cpp:\n(RenderProgress::updateFromElement):\n* Source/WebCore/rendering/RenderReplica.cpp:\n(RenderReplica::layout):\n* Source/WebCore/rendering/RenderScrollbar.cpp:\n(RenderScrollbar::buttonRect):\n* Source/WebCore/rendering/RenderTable.cpp:\n(RenderTable::layoutCaption):\n* Source/WebCore/rendering/RenderTableCell.cpp:\n(backgroundRectForRow):\n* Source/WebCore/rendering/RenderTableSection.cpp:\n(RenderTableSection::layoutRows):\n(RenderTableSection::paintObject):\n* Source/WebCore/rendering/RenderTextControlSingleLine.cpp:\n(RenderTextControlSingleLine::controlClipRect):\n* Source/WebCore/rendering/RenderTreeAsText.cpp:\n(RenderTreeAsText::writeRenderObject):\n* Source/WebCore/rendering/mathml/RenderMathMLMath.cpp:\n(RenderMathMLMath::centerChildren):\n* Source/WebCore/rendering/mathml/RenderMathMLRow.cpp:\n(RenderMathMLRow::layoutRowItems):\n* Source/WebCore/rendering/svg/RenderSVGText.cpp:\n(RenderSVGText::updatePositionAndOverflow):\n* Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp:\n(writePositionAndStyle):\n\nCanonical link: https://commits.webkit.org/316286@main",
      "email": "zalan@apple.com",
      "hash": "ebf470598457240abd83094a80f79411ef1c9115",
      "subject": "[cleanup] Rename RenderBox::frameRect()/setFrameRect() to borderBoxRectInContainer()/setBorderBoxRectInContainer()"
    },
    "316287@main": {
      "author": "Charlie Wolfe",
      "avatar": "https://www.gravatar.com/avatar/857b3b5ff3394c31fa2689310a93dbab?d=identicon\u0026s=64",
      "cl": "316287@main",
      "clUrl": "https://commits.webkit.org/316287@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317426\nrdar://180051570\n\nReviewed by Youenn Fablet.\n\nFixed the swapped ternary in RTCPacketOptions::serializableData.\n\nAlso compile out all fields but packet_id on Cocoa platforms, as they are not used.\n\n* Source/WebKit/Shared/RTCPacketOptions.cpp:\n(WebKit::RTCPacketOptions::RTCPacketOptions):\n(WebKit::RTCPacketOptions::serializableData const):\n* Source/WebKit/Shared/RTCPacketOptions.h:\n* Source/WebKit/Shared/RTCPacketOptions.serialization.in:\n\nCanonical link: https://commits.webkit.org/316287@main",
      "email": "charliew@apple.com",
      "hash": "9de1add22c90b99c1770c024c121cbe72e1eab4a",
      "subject": "RTCPacketOptions::serializableData has the SRTP auth key ternary branches swapped"
    },
    "316288@main": {
      "author": "Antoine Quint",
      "avatar": "https://www.gravatar.com/avatar/9b3ef1e754f8d994f21ff67c660cbbe6?d=identicon\u0026s=64",
      "cl": "316288@main",
      "clUrl": "https://commits.webkit.org/316288@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318328\nrdar://176539646\n\nReviewed by Simon Fraser.\n\nWe disabled Threaded Time-based Animations on CNN.com on iOS in 313551@main but\nthis quirk is no longer necessary. However, we keep the quirking plumbing around\nin case we need to disable this feature on other websites as we attempt to re-enable\nthis feature in the coming weeks.\n\n* Source/WebCore/page/Quirks.cpp:\n\nCanonical link: https://commits.webkit.org/316288@main",
      "email": "graouts@webkit.org",
      "hash": "8e9c86ec98e16ddf859b1458a88b1a101985d432",
      "subject": "[threaded-animations] enable Threaded Time-based Animations on CNN.com on iOS"
    },
    "316289@main": {
      "author": "Josh Hernandez",
      "avatar": "https://www.gravatar.com/avatar/e268e9ba8d96006649c1745a48db2f73?d=identicon\u0026s=64",
      "cl": "316289@main",
      "clUrl": "https://commits.webkit.org/316289@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317672\nrdar://180430525\n\nReviewed by Megan Gardner.\n\nExtend Find-in-Page on macOS so that a search also matches text in\nshowing WebVTT caption/subtitle cues. Navigating to a cue match seeks the\nassociated media element to the cue's start time and scrolls it into\nview, so Cmd+F / Cmd+G can step through spoken dialogue the same way it\nsteps through page text.\n\nDOM text matches and cue matches are unified through a FindMatch variant\n(SimpleRange or CueMatch) and merged in document order, so the find\ncursor and next/previous navigation move across both kinds of match in a\nsingle ordered sequence.\n\nThe behavior is gated behind the new FindInVideoEnabled feature flag,\nwhich defaults to off.\n\n* LayoutTests/media/track/text-track-find.html:\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebCore/Headers.cmake:\n* Source/WebCore/dom/Document.cpp:\n(WebCore::Document::findCueMatches):\n* Source/WebCore/page/CueMatch.h:\n* Source/WebKit/WebProcess/WebPage/FindController.cpp:\n(WebKit::mergeByDocumentOrder):\n(WebKit::indexOfCursor):\n(WebKit::FindController::countStringMatches):\n(WebKit::FindController::applyFindMatch):\n(WebKit::FindController::markMatches):\n(WebKit::FindController::getMatchCount):\n(WebKit::FindController::findString):\n(WebKit::FindController::updateFindUIAfterIncrementalFind):\n(WebKit::indexClosestToSelection):\n* Source/WebKit/WebProcess/WebPage/FindController.h:\n\nCanonical link: https://commits.webkit.org/316289@main",
      "email": "jhernandez89@apple.com",
      "hash": "e24c704e89a1182de0db8f9373f9c50668b9b4d2",
      "subject": "Include video caption cues in Find-in-Page navigation on macOS"
    },
    "316290@main": {
      "author": "Roberto Rodriguez",
      "avatar": "https://www.gravatar.com/avatar/45f4995b936231d4893f38e70cbc4805?d=identicon\u0026s=64",
      "cl": "316290@main",
      "clUrl": "https://commits.webkit.org/316290@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317890\nrdar://179684592\n\nReviewed by Ryan Reno.\n\nWhen a page uses a Content Security Policy with strict-dynamic and preloads a module script,\nthat script is blocked even though the policy should allow it.\n\nUnder strict-dynamic a script request is only blocked when its parser metadata is\n\"parser-inserted\" (CSP3 spec 6.7.1.1), and a \u003clink rel=modulepreload\u003e fetches the module\nas \"not-parser-inserted\" and stores it in the document's module map (HTML spec 4.6.8.12).\nA later parser-inserted \u003cscript type=module\u003e for the same URL reuses that entry and issues no\nnew request to check, so it must not be blocked.\n\nFix by treating the module script as non-parser-inserted using a dedicated isLinkModulePreload\nflag that only a modulepreload sets.\n\nTests: imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_modulepreload_parser_inserted_module.html\n\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_modulepreload_parser_inserted_module-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_modulepreload_parser_inserted_module.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_modulepreload_parser_inserted_module.html.headers: Added.\n* Source/WebCore/dom/ScriptElement.cpp:\n(WebCore::ScriptElement::effectiveParserInsertedForModule const):\n(WebCore::ScriptElement::requestModuleScript):\n* Source/WebCore/dom/ScriptElement.h:\n* Source/WebCore/loader/LinkLoader.cpp:\n(WebCore::LinkLoader::preloadIfNeeded):\n* Source/WebCore/loader/cache/CachedResource.cpp:\n(WebCore::CachedResource::CachedResource):\n* Source/WebCore/loader/cache/CachedResource.h:\n(WebCore::CachedResource::isLinkModulePreload const):\n(WebCore::CachedResource::setLinkModulePreload):\n* Source/WebCore/loader/cache/CachedResourceLoader.cpp:\n(WebCore::CachedResourceLoader::requestResource):\n* Source/WebCore/loader/cache/CachedResourceRequest.h:\n(WebCore::CachedResourceRequest::isLinkModulePreload const):\n(WebCore::CachedResourceRequest::setIsLinkModulePreload):\n\nCanonical link: https://commits.webkit.org/316290@main",
      "email": "roberto_rodriguez2@apple.com",
      "hash": "d74bc8454ad40a5e567fd619b4f2cfff37b93df5",
      "subject": "Preloaded module scripts are blocked under a strict-dynamic CSP"
    },
    "316291@main": {
      "author": "lilly",
      "avatar": "https://www.gravatar.com/avatar/6f92b711483096db0247c16946fb3f29?d=identicon\u0026s=64",
      "cl": "316291@main",
      "clUrl": "https://commits.webkit.org/316291@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318137\nrdar://180956416\n\nReviewed by Simon Fraser.\n\nAdds intersectsQuad to FloatQuad for testing whether two convex quads overlap.\nThe method checks all 16 pairs of edges (4 from each quad) for segment\nintersection using a cross-product sign test, two edges cross if each edge's\nendpoints fall on opposite sides of the other edge. If no edges intersect, it\nfalls back to containsPoint to handle the case where one quad is entirely\ninside the other.\n\n5 new tests written in FloatQuadTests.cpp\n\n* Source/WebCore/platform/graphics/FloatQuad.cpp:\n(WebCore::sideOf):\n(WebCore::FloatQuad::intersectsQuad const):\n* Source/WebCore/platform/graphics/FloatQuad.h:\n* Tools/TestWebKitAPI/CMakeLists.txt:\n* Tools/TestWebKitAPI/Tests/WebCore/FloatQuadTests.cpp:\n(TestWebKitAPI::TEST(FloatQuad, BoundingBoxSaturateLarge)):\n(TestWebKitAPI::TEST(FloatQuad, IntersectsQuad)):\n\nCanonical link: https://commits.webkit.org/316291@main",
      "email": "173393835+codedbycupidity@users.noreply.github.com",
      "hash": "b39363a17b0e45272c72444cabd9bb08599766e5",
      "subject": "Add FloatQuad::intersectsQuad to test intersection between two quads"
    },
    "316292@main": {
      "author": "Shu-yu Guo",
      "avatar": "https://www.gravatar.com/avatar/3884544eb9e557e2ec917d32c6e12720?d=identicon\u0026s=64",
      "cl": "316292@main",
      "clUrl": "https://commits.webkit.org/316292@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312610\nrdar://174463162\n\nReviewed by Keith Miller.\n\nAdaptiveValuePropertyInlineCacheClearingWatchpoint doesn't override isValid().\nThe base class fire() calls isValid() before dereferencing m_key.object()\nvia m_key.isWatchable() and install(). The default isValid() returns true,\nallowing fire() to dereference a potentially dead m_key.object() when the\nowning stub routine's CodeBlock has been collected.\n\nThe IC code paths that exercise this are not directly exercisable from vanilla\nJS, so a $vm.installPropertyInlineCacheClearingWatchpointWithDeadOwner is added\nto simulate the conditions that would trigger this bug.\n\nTest: JSTests/stress/regress-174463162.js\n* JSTests/stress/regress-174463162.js: Added.\n(main):\n* Source/JavaScriptCore/bytecode/PropertyInlineCacheClearingWatchpoint.h:\n* Source/JavaScriptCore/jit/GCAwareJITStubRoutine.h:\n* Source/JavaScriptCore/tools/JSDollarVM.cpp:\n(JSC::JSDollarVMHelper::setOwnerIsDead):\n(JSC::JSC_DEFINE_HOST_FUNCTION):\n(JSC::JSDollarVM::finishCreation):\n(JSC::JSDollarVM::visitChildrenImpl):\n* Source/JavaScriptCore/tools/JSDollarVM.h:\n\nOriginally-landed-as: 305413.706@safari-7624-branch (d577d4001218). rdar://180437192\nCanonical link: https://commits.webkit.org/316292@main",
      "email": "syg@apple.com",
      "hash": "c98a8ac7469499f55e3cd361171c07f77e3a9f39",
      "subject": "[JSC] Override isValid() on AdaptiveValuePropertyInlineCacheClearingWatchpoint"
    },
    "316293@main": {
      "author": "Nathan Solomon",
      "avatar": "https://www.gravatar.com/avatar/511ed1e062e5bfec8adff762a004a148?d=identicon\u0026s=64",
      "cl": "316293@main",
      "clUrl": "https://commits.webkit.org/316293@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318181\nrdar://176048636\n\nReviewed by Antti Koivisto.\n\nHTMLInputElement::setChecked updates an input element's checked state and\nunconditionally calls invalidateStyle() that forces a full style\nresolution of the input on every checked-state change. This explicit invalidateStyle() is not needed with the\nPseudoClassChangeInvalidation already constructed at the top of the function, which invalidates\nthe elements whose style depends on :checked and does nothing when no :checked rule applies. The\ninvalidateStyle() adds only an unconditional self-invalidation, which produces no style change in the\ncase where the input matches no :checked rule. This is safe to remove because flipping the checked\nbit can only change an element's computed style through :checked selector matching in SelectorChecker\nwhen evaluating the :checked pseudo-class. Nowhere else in style resolution reads the checked state.\nBefore this change, if no :checked rule matches the input element, we were still doing style resolution,\nbut the resolved style was identical before vs after the toggle which wasted work.\n\nThe one checked state-dependent visual that isn't CSS is the painted checkmark, which setChecked()\nalready repaints via renderer-\u003erepaint() for native form controls,\nso the painting of the checkmark does not depend on style invalidation either.\n\n* LayoutTests/fast/selectors/checked-subject-style-update-expected.txt: Added.\n* LayoutTests/fast/selectors/checked-subject-style-update.html: Added.\n* Source/WebCore/html/HTMLInputElement.cpp:\n(WebCore::HTMLInputElement::setChecked):\n\nCanonical link: https://commits.webkit.org/316293@main",
      "email": "nathan_solomon@apple.com",
      "hash": "8bf70588e2a902733a0e95f07571640bf1bb6e5b",
      "subject": "Remove invalidateStyle() call from HTMLInputElement::setChecked()"
    },
    "316294@main": {
      "author": "Yury Semikhatsky",
      "avatar": "https://www.gravatar.com/avatar/d0aee26d9689e84bd1a7f0ed8f262fe1?d=identicon\u0026s=64",
      "cl": "316294@main",
      "clUrl": "https://commits.webkit.org/316294@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318294\n\nReviewed by Devin Rousso.\n\nPageRuntimeAgent forces a frame's main-world global object to be created\nso script-less frames get an execution context. That creation re-enters\ndidClearWindowObjectInWorld, so Runtime.executionContextCreated was\ndispatched twice and Page bootstrap scripts ran twice. Track the forced\ndispatch on PageRuntimeAgent and skip the re-entrant one.\n\nTest: inspector/page/setBootstrapScript-runs-once-per-navigation.html\n\n* LayoutTests/inspector/page/resources/scriptless-subframe.html: Added.\n* LayoutTests/inspector/page/setBootstrapScript-runs-once-per-navigation-expected.txt: Added.\n* LayoutTests/inspector/page/setBootstrapScript-runs-once-per-navigation.html: Added.\n* Source/WebCore/inspector/agents/InspectorPageAgent.cpp:\n(WebCore::InspectorPageAgent::didClearWindowObjectInWorld):\n* Source/WebCore/inspector/agents/page/PageRuntimeAgent.cpp:\n(WebCore::PageRuntimeAgent::frameNavigated):\n(WebCore::PageRuntimeAgent::didClearWindowObjectInWorld):\n* Source/WebCore/inspector/agents/page/PageRuntimeAgent.h:\n\nCanonical link: https://commits.webkit.org/316294@main",
      "email": "yurys@chromium.org",
      "hash": "df88b37022bb15f2a79cf9f70731ecb2f4204454",
      "subject": "[Web Inspector] didClearWindowObject is dispatched twice for script-less frames"
    },
    "316296@main": {
      "author": "Yulun Wu",
      "avatar": "https://www.gravatar.com/avatar/9e34d6632f4d926cdf6fe8dce07f9cb7?d=identicon\u0026s=64",
      "cl": "316296@main",
      "clUrl": "https://commits.webkit.org/316296@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317964\n\u003crdar://180748205\u003e\n\nReviewed by Sammy Gill.\n\nGrid items with stretch preferred sizes were not correctly implementing the spec:\n\nhttps://www.w3.org/TR/css-grid-2/#algo-single-span-items\n\nSpecifically, if the item’s computed preferred size behaves as auto or depends\non the size of its containing block in the relevant axis, its minimum contribution\nis the outer size that would result from assuming the item’s used minimum size as\nits preferred size; else the item’s minimum contribution is its min-content contribution.\n\nSpecifically, we were not fully respecting/evaluating:\n\n\t\"depends on the size of its containing block in the relevant axis\"\n\nAs we were only handling isPercentOrCalculated() and incorrectly letting stretch slip by.\n\nThis PR split the check into two spec-named predicates, behavesAsAuto() and\ndependsOnContainingBlockSize(), to clarify where and how we are following spec.\n\n* LayoutTests/fast/css-grid-layout/grid-item-min-contribution-fill-available-expected.txt: Added.\n* LayoutTests/fast/css-grid-layout/grid-item-min-contribution-fill-available.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-items/grid-item-min-contribution-behaves-as-auto-001-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-items/grid-item-min-contribution-behaves-as-auto-001.html: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-items/grid-item-min-contribution-fit-content-001-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/css/css-grid/grid-items/grid-item-min-contribution-fit-content-001.html: Added.\n* Source/WebCore/rendering/GridTrackSizingAlgorithm.cpp:\n(WebCore::GridTrackSizingAlgorithmStrategy::minContributionForGridItem const):\n\nCanonical link: https://commits.webkit.org/316296@main",
      "email": "yulun_wu@apple.com",
      "hash": "0c5ae4f07adc83be7ce540665d2a0d68ece80ebf",
      "subject": "[Grid] Grid items with stretch preferred size have incorrect min content contributions."
    },
    "316297@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "316297@main",
      "clUrl": "https://commits.webkit.org/316297@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318061\n\nReviewed by Antti Koivisto.\n\nThe public section of RenderBox.h had accumulated declarations in a fairly random\norder. Group them by functionality -- position/size, box-edge rects, margins, overflow,\nscrolling, sizing, painting, hit testing, coordinate mapping, fragmentation, tree\nnavigation, and so on -- so related methods sit together. The reordering does not\nchange any declaration.\n\nAlso move tryLayoutDoingOutOfFlowMovementOnly() and\nmarkShapeOutsideDependentsForLayout() out of the class body into RenderBoxInlines.h,\nmatching how the rest of RenderBox's inlines are defined, and drop the unused\nhasHorizontalLayoutOverflow()/hasVerticalLayoutOverflow(). No behavior change.\n\n* Source/WebCore/rendering/RenderBox.h:\n(WebCore::RenderBox::location const):\n(WebCore::RenderBox::locationOffset const):\n(WebCore::RenderBox::borderBoxWidth const):\n(WebCore::RenderBox::borderBoxHeight const):\n(WebCore::RenderBox::borderBoxSize const):\n(WebCore::RenderBox::borderBoxRectInContainer const):\n(WebCore::RenderBox::setLocation):\n(WebCore::RenderBox::setBorderBoxSize):\n(WebCore::RenderBox::setBorderBoxInContainer):\n(WebCore::RenderBox::move):\n(WebCore::RenderBox::layoutOverflowRect const):\n(WebCore::RenderBox::visualOverflowRect const):\n(WebCore::RenderBox::hasRenderOverflow const):\n(WebCore::RenderBox::hasVisualOverflow const):\n(WebCore::RenderBox::applyVisualEffectOverflow):\n(WebCore::RenderBox::addOverflowFromInFlowChildren):\n(WebCore::RenderBox::addOverflowFromContainedBox):\n(WebCore::RenderBox::stopAutoscroll):\n(WebCore::RenderBox::hasIntrinsicAspectRatio const):\n(WebCore::RenderBox::adjustBorderBoxRectForPainting):\n(WebCore::RenderBox::markForPaginationRelayoutIfNeeded):\n(WebCore::RenderBox::firstLineBaseline const):\n(WebCore::RenderBox::lastLineBaseline const):\n(WebCore::RenderBox::isGridItem const):\n(WebCore::RenderBox::isFlexItem const):\n(WebCore::RenderBox::tryLayoutDoingOutOfFlowMovementOnly): Deleted.\n(WebCore::RenderBox::hasHorizontalLayoutOverflow const): Deleted.\n(WebCore::RenderBox::hasVerticalLayoutOverflow const): Deleted.\n(WebCore::RenderBox::markShapeOutsideDependentsForLayout): Deleted.\n* Source/WebCore/rendering/RenderBoxInlines.h:\n(WebCore::RenderBox::tryLayoutDoingOutOfFlowMovementOnly):\n(WebCore::RenderBox::markShapeOutsideDependentsForLayout):\n\nCanonical link: https://commits.webkit.org/316297@main",
      "email": "zalan@apple.com",
      "hash": "bc8e9b9cc39741f7727d1bb70ecb9f555b8770ca",
      "subject": "[cleanup] Tidy up the RenderBox.h header (group methods, move inline bodies out)"
    },
    "316298@main": {
      "author": "Anand Srinivasan",
      "avatar": "https://www.gravatar.com/avatar/84643a20c269974c2df6681742daf0a4?d=identicon\u0026s=64",
      "cl": "316298@main",
      "clUrl": "https://commits.webkit.org/316298@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=313590\nrdar://175673870\n\nReviewed by Dan Hecht.\n\nIPIntControlType::m_pendingOffset was int32_t but stored values from\nm_metadata-\u003em_metadata.size(). A function within maxFunctionSize can\ngenerate metadata exceeding INT32_MAX via repeated calls to functions\nwith large signatures.\n\nAdd overflow checks to the 32 bit computations to avoid silently\nproducing invalid metadata addresses, and change m_pendingOffset to use\nstd::optional instead of a sentinel value.\n\nA practical test would take too long to include.\n\n* Source/JavaScriptCore/wasm/WasmIPIntGenerator.cpp:\n(JSC::Wasm::IPIntGenerator::tryToResolveBranchTarget):\n(JSC::Wasm::IPIntGenerator::curPC):\n(JSC::Wasm::IPIntGenerator::nextPC):\n(JSC::Wasm::IPIntGenerator::curMC):\n(JSC::Wasm::IPIntGenerator::checkedDelta):\n(JSC::Wasm::IPIntGenerator::coalesceControlFlow):\n(JSC::Wasm::IPIntGenerator::resolveEntryTarget):\n(JSC::Wasm::IPIntGenerator::resolveExitTarget):\n(JSC::Wasm::IPIntGenerator::addLoop):\n(JSC::Wasm::IPIntGenerator::addIf):\n(JSC::Wasm::IPIntGenerator::addElseToUnreachable):\n(JSC::Wasm::IPIntGenerator::addCatchToUnreachable):\n(JSC::Wasm::IPIntGenerator::addCatchAllToUnreachable):\n(JSC::Wasm::IPIntGenerator::addDelegateToUnreachable):\n(JSC::Wasm::IPIntGenerator::addEndToUnreachable):\n\nOriginally-landed-as: 305413.828@safari-7624-branch (d446d220d636). rdar://180428054\nCanonical link: https://commits.webkit.org/316298@main",
      "email": "anand_srinivasan@apple.com",
      "hash": "b44e37ce8f99bf4f83f4d28f8a1e3ab9e99a93aa",
      "subject": "Change IPInt m_pendingOffset to std::optional and add metadata offset overflow assertions"
    },
    "316299@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316299@main",
      "clUrl": "https://commits.webkit.org/316299@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314700\nrdar://176819800\n\nReviewed by Per Arne Vollan.\n\nThe block passed to `[WKMarketplaceKit requestAppInstallationWithTopOrigin:]`\nmay get called on a non-main thread, causing us to call addConsoleError()\non that thread and crash since we expect `addConsoleError()` to always\nrun on the main thread.\n\nAddress the issue by calling `ensureOnMainRunLoop()` to get back to the\nmain thread before calling `addConsoleError()`.\n\n* Source/WebKit/UIProcess/Cocoa/NavigationState.mm:\n(WebKit::interceptMarketplaceKitNavigation):\n\nOriginally-landed-as: 305413.897@safari-7624-branch (9911c5cf48d3). rdar://180436028\nCanonical link: https://commits.webkit.org/316299@main",
      "email": "cdumez@apple.com",
      "hash": "8ec02226e267b1fc36c96ff7f6ae2bee11d90fca",
      "subject": "Use-after-free in WebPageProxy::sendToWebPage from off-main-thread WKMarketplaceKit completion (interceptMarketplaceKitNavigation)"
    },
    "316300@main": {
      "author": "Antoine Quint",
      "avatar": "https://www.gravatar.com/avatar/9b3ef1e754f8d994f21ff67c660cbbe6?d=identicon\u0026s=64",
      "cl": "316300@main",
      "clUrl": "https://commits.webkit.org/316300@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314104\nrdar://176274648\n\nReviewed by Anne van Kesteren.\n\nIf the timeline associated with an animation is a plain scroll timeline, but not a view timeline,\nwe must resolve any offset using a view progress timeline range by simply disregarding the keyword.\nThis ensures we have resolved computed offsets in such a case, ensuring we do not crash when attempting\nto create the `AcceleratedEffect` representation for this keyframe effect.\n\nTest: imported/w3c/web-platform-tests/scroll-animations/css/timeline-offset-keyframes-with-scroll-timeline.html\n\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/timeline-offset-keyframes-with-scroll-timeline-expected.txt: Added.\n* LayoutTests/imported/w3c/web-platform-tests/scroll-animations/css/timeline-offset-keyframes-with-scroll-timeline.html: Added.\n* Source/WebCore/animation/KeyframeEffect.cpp:\n(WebCore::computedOffset):\n(WebCore::computeMissingKeyframeOffsets):\n(WebCore::KeyframeEffect::getKeyframes):\n(WebCore::KeyframeEffect::processKeyframes):\n(WebCore::KeyframeEffect::animationDidTick):\n(WebCore::KeyframeEffect::activeScrollTimeline const):\n(WebCore::KeyframeEffect::updateComputedKeyframeOffsetsIfNeeded):\n(WebCore::KeyframeEffect::activeViewTimeline const): Deleted.\n* Source/WebCore/animation/KeyframeEffect.h:\n\nOriginally-landed-as: 305413.839@safari-7624-branch (4a52a36ff580). rdar://180438807\nCanonical link: https://commits.webkit.org/316300@main",
      "email": "graouts@webkit.org",
      "hash": "b4165ba22e9f017022eeedfe59266113cdd0d8c2",
      "subject": "[web-animations] accelerated animation with view progress timeline range and a scroll time yields a crash"
    },
    "316301@main": {
      "author": "Eric Carlson",
      "avatar": "https://www.gravatar.com/avatar/e227ff07cc6d645fc1c69fd56c2c8cb8?d=identicon\u0026s=64",
      "cl": "316301@main",
      "clUrl": "https://commits.webkit.org/316301@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318222\nrdar://180728609\n\nReviewed by Youenn Fablet.\n\nPer the MediaCapture Extensions specification, when a source-side\nconfiguration change occurs while a MediaStreamTrack is muted, the\nconfigurationchange event must be deferred until the track is no longer\nmuted (or the track ends). WebKit instead queued the task immediately\nand aborted it on dispatch when the track was still muted, dropping the\nevent entirely. After unmute, no event ever fired for the missed change.\n\nRecord that a configurationchange was suppressed while muted, and flush\nit from the unmute path after the unmute event is dispatched. Multiple\nnotifications while muted coalesce into a single event on unmute.\n\nTest: fast/mediastream/mediastreamtrack-configurationchange-while-muted.html\n\n* LayoutTests/fast/mediastream/configurationchange-defer-and-abort-expected.txt:\n* LayoutTests/fast/mediastream/mediastreamtrack-configurationchange-while-muted-expected.txt: Added.\n* LayoutTests/fast/mediastream/mediastreamtrack-configurationchange-while-muted.html: Added.\n* Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp:\n(WebCore::MediaStreamTrack::trackMutedChanged):\n(WebCore::MediaStreamTrack::trackConfigurationChanged):\n* Source/WebCore/Modules/mediastream/MediaStreamTrack.h:\n\nCanonical link: https://commits.webkit.org/316301@main",
      "email": "eric.carlson@apple.com",
      "hash": "7c9125971d94c50643fee08e076840fc700806f7",
      "subject": "`configurationchange` event is dropped when MediaStream track configuration changes while track is muted"
    },
    "316302@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316302@main",
      "clUrl": "https://commits.webkit.org/316302@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318314\nrdar://181103367\n\nReviewed by Aditya Keerthi.\n\nDataTransferItem.h forward-declared class DataTransferListItem, a transposed\nmisspelling of DataTransferItemList. It was never referenced anywhere in the\ntree, so remove it.\n\n* Source/WebCore/dom/DataTransferItem.h:\n\nCanonical link: https://commits.webkit.org/316302@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "7136b90d351d8746218825a1625be195b1a3e2d8",
      "subject": "Remove stale misspelled forward declaration DataTransferListItem from DataTransferItem.h"
    },
    "316303@main": {
      "author": "Eric Carlson",
      "avatar": "https://www.gravatar.com/avatar/e227ff07cc6d645fc1c69fd56c2c8cb8?d=identicon\u0026s=64",
      "cl": "316303@main",
      "clUrl": "https://commits.webkit.org/316303@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=308155\nrdar://170662797\n\nReviewed by Youenn Fablet and Jer Noble.\n\n`AudioSession::tryToSetActive(bool)` now returns\n`Ref\u003cSetActivePromise\u003e` instead of a synchronous `bool`. This is\na prerequisite for moving the media session manager completely out of\nthe WebContent process under site isolation: the existing sync IPC from\nWebContent to the GPU process that confirmed audio session activation\ncannot be extended to an additional UI-process hop without making the\nentire chain async.\n\nThe `TryToSetActive` IPC message is now reply-with-promise rather than\nsynchronous, so `RemoteAudioSession::tryToSetActiveInternal()` no\nlonger blocks the WebContent main thread on a GPU round-trip.\n`MediaSessionManagerInterface::sessionWillBeginPlayback()` is\nrestructured: when activation is already in place it takes the\nfast synchronous path and fires its completion handler inline; when\nactivation is required it chains the completion handler off the\nactivation promise via `whenSettled()`.\n\n`MediaSessionManagerInterface::maybeActivateAudioSession()` returns\nits own promise, and gives each concurrent caller its own\n`GenericPromise::Producer` (held in `m_activationWaiters`) so multiple\ncallers can chain off a single in-flight activation. The producers are\nsettled together when the underlying `tryToSetActive(true)` completes.\n\n`RemoteAudioSession::tryToSetActiveInternal()` keeps at most one IPC\nin flight at a time using a FIFO chain (`m_pendingActivationChain`).\nConsecutive same-state requests coalesce against the tail of the\nchain into a single IPC; alternating-state requests append a new\nentry that is dispatched when the previous reply arrives. Serializing\nat this layer preserves request ordering independently of how\n`AudioSessionCocoa::tryToSetActiveInternal()` is implemented, which\nmatters once activation there becomes truly non-blocking.\n\n`AudioSessionCocoa::tryToSetActiveInternal()` activation still uses\n`dispatchSync` internally; only deactivation is fully async at this\nlayer for now. The promise infrastructure is in place to make\nactivation non-blocking in a follow-up change.\n\nAdd an AsyncAudioSessionActivationEnabled runtime preference (default true). When this\npreference is false it makes the IPC to the GPU process synchronous, to make it easier to\ntest if regressions are caused by the change to async IPC or by the change to using\nNativePromise in the AudioSession activation code path.\n\nFix a pre-existing clearInterval(checkCurrentTime) bug in video-currenttime-monotonic.html\nthat caused spurious \"time went backward\" failures when the interval kept running across\nvideo-end boundaries.\n\nNo change in observable behavior. Covered by existing tests.\n\n* LayoutTests/media/picture-in-picture/video-playback-system-interruption-and-resume-expected.txt:\n* LayoutTests/media/picture-in-picture/video-playback-system-interruption-and-resume.html:\n* LayoutTests/media/video-currenttime-monotonic.html:\n* LayoutTests/media/video-seek-after-end-play-expected.txt:\n* LayoutTests/platform/glib/media/video-seek-after-end-play-expected.txt: Copied from LayoutTests/media/video-seek-after-end-play-expected.txt.\n* LayoutTests/platform/mac-site-isolation/TestExpectations:\n* Source/WTF/Scripts/Preferences/UnifiedWebPreferences.yaml:\n* Source/WebCore/Modules/audiosession/DOMAudioSession.cpp:\n(WebCore::DOMAudioSession::scheduleStateChangeEvent):\n* Source/WebCore/Modules/mediastream/UserMediaRequest.cpp:\n(WebCore::UserMediaRequest::allow):\n* Source/WebCore/Modules/webaudio/AudioContext.cpp:\n(WebCore::AudioContext::close):\n(WebCore::AudioContext::suspendRendering):\n(WebCore::AudioContext::resumeRendering):\n(WebCore::AudioContext::startRendering):\n(WebCore::AudioContext::lazyInitialize):\n(WebCore::AudioContext::mayResumePlayback):\n(WebCore::AudioContext::suspendPlayback):\n* Source/WebCore/Modules/webaudio/BaseAudioContext.h:\n(WebCore::BaseAudioContext::isRunning const):\n* Source/WebCore/html/HTMLMediaElement.cpp:\n(WebCore::HTMLMediaElement::load):\n(WebCore::HTMLMediaElement::prepareForLoad):\n(WebCore::HTMLMediaElement::selectMediaResource):\n(WebCore::HTMLMediaElement::completePlayInternal):\n(WebCore::HTMLMediaElement::playInternal):\n(WebCore::HTMLMediaElement::pauseInternal):\n* Source/WebCore/html/HTMLMediaElement.h:\n* Source/WebCore/platform/audio/AudioSession.cpp:\n(WebCore::AudioSession::tryToSetActive):\n(WebCore::AudioSession::tryToSetActiveInternal):\n* Source/WebCore/platform/audio/AudioSession.h:\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.cpp:\n(WebCore::MediaSessionManagerInterface::sessionWillBeginPlayback):\n(WebCore::MediaSessionManagerInterface::enforceConcurrentPlaybackRestriction):\n(WebCore::MediaSessionManagerInterface::maybeDeactivateAudioSession):\n(WebCore::MediaSessionManagerInterface::maybeActivateAudioSession):\n* Source/WebCore/platform/audio/MediaSessionManagerInterface.h:\n* Source/WebCore/platform/audio/PlatformMediaSession.cpp:\n(WebCore::PlatformMediaSession::clientWillBeginPlayback):\n(WebCore::PlatformMediaSession::processClientWillPausePlayback):\n(WebCore::PlatformMediaSession::canProduceAudioChanged):\n* Source/WebCore/platform/audio/cocoa/AudioSessionCocoa.h:\n* Source/WebCore/platform/audio/cocoa/AudioSessionCocoa.mm:\n(WebCore::AudioSessionCocoa::tryToSetActiveInternal):\n* Source/WebCore/testing/Internals.cpp:\n(WebCore::Internals::resetToConsistentState):\n* Source/WebKit/GPUProcess/media/RemoteAudioSessionProxy.cpp:\n(WebKit::RemoteAudioSessionProxy::tryToSetActive):\n(WebKit::RemoteAudioSessionProxy::tryToSetActiveSync):\n* Source/WebKit/GPUProcess/media/RemoteAudioSessionProxy.h:\n* Source/WebKit/GPUProcess/media/RemoteAudioSessionProxy.messages.in:\n* Source/WebKit/GPUProcess/media/RemoteAudioSessionProxyManager.cpp:\n(WebKit::RemoteAudioSessionProxyManager::tryToSetActiveForProcess):\n* Source/WebKit/GPUProcess/media/RemoteAudioSessionProxyManager.h:\n* Source/WebKit/GPUProcess/webrtc/UserMediaCaptureManagerProxy.cpp:\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.cpp:\n(WebKit::RemoteMediaSessionManagerProxy::tryToSetActiveInternal):\n* Source/WebKit/UIProcess/Media/RemoteMediaSessionManagerProxy.h:\n* Source/WebKit/WebProcess/GPU/media/RemoteAudioSession.cpp:\n(WebKit::RemoteAudioSession::tryToSetActiveInternal):\n(WebKit::RemoteAudioSession::sendNextActivationIPC):\n* Source/WebKit/WebProcess/GPU/media/RemoteAudioSession.h:\n* Source/WebKit/WebProcess/Media/RemoteMediaSessionManager.cpp:\n(WebKit::RemoteMediaSessionManager::tryToSetAudioSessionActive):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/MediaSession.mm:\n(TestWebKitAPI::MediaSessionTest::loadPageAndBecomeNowPlaying):\n\nCanonical link: https://commits.webkit.org/316303@main",
      "email": "eric.carlson@apple.com",
      "hash": "5ba0022932fe7497c614dca03712cc2d9a7c621d",
      "subject": "[Site isolation] Make AudioSession activation asynchronous"
    },
    "316304@main": {
      "author": "Richard Robinson",
      "avatar": "https://www.gravatar.com/avatar/a0d2f862985ed0fd47887be66f5a3e4f?d=identicon\u0026s=64",
      "cl": "316304@main",
      "clUrl": "https://commits.webkit.org/316304@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318293\nrdar://181076925\n\nReviewed by Abrar Rahman Protyasha.\n\nThe calculations in `PositionInformationForWebPage.mm` were using the wrong coordinate space\nwhen performing hit-testing. This underlying issue revealed itself when the page has a top content\ninset applied, since then point is displaced and the wrong element is \"hit\".\n\nWhen the scroll position is roughly the same as the size of the content inset, they cancel each other\nout, which is why the bug only reproduces on some scroll offsets, and only on certain page layouts\nwhen there's a selectable and non-selectable element vertically near each other.\n\nFix by using the correct coordinate space.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift\n\n* Source/WebCore/page/EventHandler.cpp:\n(WebCore::EventHandler::hitTestResultAtPoint const):\n* Source/WebCore/page/EventHandler.h:\n* Source/WebKit/WebProcess/WebPage/Cocoa/PositionInformationForWebPage.mm:\n(WebKit::selectionPositionInformation):\n(WebKit::textInteractionPositionInformation):\n(WebKit::positionInformationForWebPage):\n* Tools/TestWebKitAPI/Tests/WebKit/WebPage/AppKit Gesture Tests/BasicAppKitGesturesTests.swift:\n(AppKitGesturesTests.doubleClickingSelectsWordWhenScrolledToTopWithObscuredContentInset):\n\nCanonical link: https://commits.webkit.org/316304@main",
      "email": "richard_robinson2@apple.com",
      "hash": "191b1f341a7e02b3fa6b67fc479f7b9ed05a4acc",
      "subject": "[AppKit Gestures] Double-clicking to select a word when scrolled to the top with obscured content insets sometimes doesn't work"
    },
    "316305@main": {
      "author": "Mike Wyrzykowski",
      "avatar": "https://www.gravatar.com/avatar/4b1bc9e238714f95e22d5d2454c07066?d=identicon\u0026s=64",
      "cl": "316305@main",
      "clUrl": "https://commits.webkit.org/316305@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317988\nrdar://180664638\n\nReviewed by Ruthvik Konda.\n\nPrefer model time over the cached time, not the other way around.\n\n* Source/WebKit/WebProcess/Model/WebModelPlayer.mm:\n(WebKit::WebModelPlayer::currentTime const):\n\nCanonical link: https://commits.webkit.org/316305@main",
      "email": "mwyrzykowski@apple.com",
      "hash": "aebade889cf2ee807608cec3f7459deeac135f47",
      "subject": "Current Time should match the element's animation when autoplay is on"
    },
    "316306@main": {
      "author": "Jetzel Espinal",
      "avatar": "https://www.gravatar.com/avatar/2edd78d5d9f2f2e2e695465277634921?d=identicon\u0026s=64",
      "cl": "316306@main",
      "clUrl": "https://commits.webkit.org/316306@main",
      "description": "rdar://181059634\n\nUnreviewed test gardening.\n\n* TestExpectations/apitests:\n\nCanonical link: https://commits.webkit.org/316306@main",
      "email": "jespinal23@apple.com",
      "hash": "8f87750a431e7f89294e0c7440a2e16e92c9e95c",
      "subject": "[GARDENING] 3x TestWebKitAPI.WKWebExtensionAPIDeclarativeNetRequest.* (api-test) are constant timeouts (318265)."
    },
    "316307@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "316307@main",
      "clUrl": "https://commits.webkit.org/316307@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318320\nrdar://181105431\n\nReviewed by Sosuke Suzuki.\n\nThis patch inlines StringSlice's rope construction path in FTL, as\nthis is really hot in many of workloads. We are preparing the similar\nthing to StringSubstring etc. as well.\n\n* Source/JavaScriptCore/ftl/FTLLowerDFGToB3.cpp:\n(JSC::FTL::DFG::LowerDFGToB3::compileCompareStrictEq):\n\nCanonical link: https://commits.webkit.org/316307@main",
      "email": "ysuzuki@apple.com",
      "hash": "eeb2440ba085136496a90de543f848d09090d108",
      "subject": "[JSC] Inline StringSlice rope construction in FTL"
    },
    "316308@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "316308@main",
      "clUrl": "https://commits.webkit.org/316308@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318177\nrdar://180988076\n\nReviewed by Yijia Huang and Justin Michaud.\n\nOriginally this phase existed because we were emitting Air inst directly\nfrom Wasm BBQ, and we do not want to emit low-level sequence of\nAir instructions for SIMD etc. But it is not happening now and it does\nnot make sense to have this phase since B3 is basically a macro for Air.\nWe should directly lower B3 nodes to Air instead of using some Air nodes\nas a macro.\n\nWe also track the use of ColdCCall and Shuffle, and run\nlowerAfterRegAlloc only when we have these Air insts. They are rare ones\nso we may not have them in major cases.\n\n* Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj:\n* Source/JavaScriptCore/Sources.txt:\n* Source/JavaScriptCore/b3/B3LowerToAir.cpp:\n* Source/JavaScriptCore/b3/B3Procedure.h:\n(JSC::B3::Procedure::setUsesColdCCall):\n(JSC::B3::Procedure::usesColdCCall const):\n(JSC::B3::Procedure::setUsesShuffle):\n(JSC::B3::Procedure::usesShuffle const):\n* Source/JavaScriptCore/b3/air/AirAllocateRegistersByGreedy.cpp:\n(JSC::B3::Air::Greedy::GreedyAllocator::insertFixupCode):\n* Source/JavaScriptCore/b3/air/AirCustom.h:\n* Source/JavaScriptCore/b3/air/AirEmitShuffle.cpp:\n(JSC::B3::Air::createShuffle):\n* Source/JavaScriptCore/b3/air/AirEmitShuffle.h:\n* Source/JavaScriptCore/b3/air/AirGenerate.cpp:\n(JSC::B3::Air::prepareForGeneration):\n* Source/JavaScriptCore/b3/air/AirLowerAfterRegAlloc.cpp:\n(JSC::B3::Air::lowerAfterRegAlloc):\n* Source/JavaScriptCore/b3/air/AirLowerMacros.cpp: Removed.\n* Source/JavaScriptCore/b3/air/AirLowerMacros.h: Removed.\n* Source/JavaScriptCore/b3/air/AirOpcode.opcodes:\n* Source/JavaScriptCore/b3/air/testair.cpp:\n\nCanonical link: https://commits.webkit.org/316308@main",
      "email": "ysuzuki@apple.com",
      "hash": "0f2107b6d20520db631fb3321211c53d17c3235f",
      "subject": "[JSC] Remove Air::lowerMacros"
    },
    "316309@main": {
      "author": "Claudio Saavedra",
      "avatar": "https://www.gravatar.com/avatar/376a6edb56b8e52de407ea171c869bcf?d=identicon\u0026s=64",
      "cl": "316309@main",
      "clUrl": "https://commits.webkit.org/316309@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318361\n\nUnreviewed build fix.\n\n* Source/JavaScriptCore/bytecode/PropertyInlineCacheClearingWatchpoint.h:\n* Source/JavaScriptCore/tools/JSDollarVM.cpp:\n\nCanonical link: https://commits.webkit.org/316309@main",
      "email": "csaavedra@igalia.com",
      "hash": "cfd4b22815c5508b81c04d41368eb062071ce593",
      "subject": "REGRESSION(316292@main): Fix WPE build"
    },
    "316310@main": {
      "author": "Matthew Finkel",
      "avatar": "https://www.gravatar.com/avatar/656f8950aefb56f553c899418e06b351?d=identicon\u0026s=64",
      "cl": "316310@main",
      "clUrl": "https://commits.webkit.org/316310@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318296\nrdar://problem/181081781\n\nReviewed by Alex Christensen.\n\nThis is only a setting for WK2. The setting is disabled by default, and it\nallows loading a page with any TLS certificate (regardless of passing\nvalidation).  If the setting is enabled, then we accept an invalid certificate\nand continue loading the page.\n\n* Tools/MiniBrowser/mac/SettingsController.h:\n* Tools/MiniBrowser/mac/SettingsController.m:\n(-[SettingsController _populateMenu:]):\n(-[SettingsController validateMenuItem:]):\n(-[SettingsController toggleAcceptAllTLSCertificates:]):\n(-[SettingsController acceptAllTLSCertificates]):\n* Tools/MiniBrowser/mac/WK2BrowserWindowController.m:\n(-[WK2BrowserWindowController webView:didReceiveAuthenticationChallenge:completionHandler:]):\n\nCanonical link: https://commits.webkit.org/316310@main",
      "email": "m_finkel@apple.com",
      "hash": "a59dfde83041b73130bc86f01dbb0fc2702f66af",
      "subject": "[cocoa] Add MiniBrowser setting for allowing all TLS certificates"
    },
    "316311@main": {
      "author": "Dana Estra",
      "avatar": "https://www.gravatar.com/avatar/bb57a3e383fc407cd4b341aeef87d877?d=identicon\u0026s=64",
      "cl": "316311@main",
      "clUrl": "https://commits.webkit.org/316311@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318277\nrdar://172678303\n\nReviewed by Jer Noble.\n\nAuto-generated subtitles use the 708 caption code path, which is always\nnon-wrapping. This patch adopts new Core Media SPI\nkCMTextMarkupAttribute_PreventLineWrapping. When the attribute's value is\ntrue, we continue setting text-wrap:nowrap on the vtt cue. When the attribute's\nvalue is false, we set text-wrap:wrap.\n\nNo new tests.\n\n* Source/WebCore/Configurations/AllowedSPI.toml:\n* Source/WebCore/PAL/pal/cf/CoreMediaSoftLink.cpp:\n* Source/WebCore/PAL/pal/cf/CoreMediaSoftLink.h:\n* Source/WebCore/html/track/InbandGenericTextTrack.cpp:\n(WebCore::InbandGenericTextTrack::updateCueFromCueData):\n* Source/WebCore/html/track/TextTrackCueGeneric.cpp:\n(WebCore::TextTrackCueGeneric::cueContentsMatch const):\n(WebCore::TextTrackCueGeneric::toJSON const):\n* Source/WebCore/html/track/TextTrackCueGeneric.h:\n* Source/WebCore/html/track/VTTCue.cpp:\n(WebCore::VTTCueBox::applyCSSProperties):\n* Source/WebCore/html/track/VTTCue.h:\n(WebCore::VTTCue::wrapTextDuringPercentageBasedPositioning const):\n* Source/WebCore/platform/graphics/InbandGenericCue.cpp:\n(WebCore::InbandGenericCue::toJSONString const):\n(WebCore::GenericCueData::equalNotConsideringTimesOrId const):\n* Source/WebCore/platform/graphics/InbandGenericCue.h:\n(WebCore::GenericCueData::GenericCueData):\n(WebCore::InbandGenericCue::preventLineWrapping const):\n(WebCore::InbandGenericCue::setPreventLineWrapping):\n* Source/WebCore/platform/graphics/avfoundation/InbandTextTrackPrivateAVF.cpp:\n(WebCore::InbandTextTrackPrivateAVF::processCueAttributes):\n* Source/WebKit/Shared/WebCoreArgumentCodersMedia.serialization.in:\n\nCanonical link: https://commits.webkit.org/316311@main",
      "email": "destra@apple.com",
      "hash": "91bf4045be338d5e67dd6dc30835720564d0c5ad",
      "subject": "Generated transcriptions on Safari HLS Videos are not line breaking"
    },
    "316312@main": {
      "author": "Brady Eidson",
      "avatar": "https://www.gravatar.com/avatar/31bed81d6d8ef517f93b30add03f5651?d=identicon\u0026s=64",
      "cl": "316312@main",
      "clUrl": "https://commits.webkit.org/316312@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=314155\n\nUnreviewed.\n\nMis-merged the final patch for landing, and didn't have EWS to catch the obvious mistake.\n\n* Tools/TestWebKitAPI/Tests/WebKit/WKBackForwardListTests.mm:\n(ForgedFileURLItemIsRejected)):\n\nOriginally-landed-as: 305413.832@safari-7624-branch (d115edca4bb9). rdar://181073975\nCanonical link: https://commits.webkit.org/316312@main",
      "email": "beidson@apple.com",
      "hash": "a27bc974417b77fa2c72fc835e5334978706f47d",
      "subject": "Build fix after 249edf86a9f55"
    },
    "316313@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316313@main",
      "clUrl": "https://commits.webkit.org/316313@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318299\nrdar://181094089\n\nReviewed by Simon Fraser.\n\nThe postConnectionSteps() work lambda manually set m_openingURLAfterInserting\nto true and reset it to false at the end of the block. Replace this with a\nSetForScope guard so the flag is restored unconditionally when the scope exits,\nmatching the idiom used elsewhere in WebCore. No change in behavior.\n\n* Source/WebCore/html/HTMLFrameElementBase.cpp:\n(WebCore::HTMLFrameElementBase::postConnectionSteps):\n\nCanonical link: https://commits.webkit.org/316313@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "800fdbd20f16a4985c4d5b08a3a2cdca61d8349f",
      "subject": "Use SetForScope for HTMLFrameElementBase::m_openingURLAfterInsertin"
    },
    "316315@main": {
      "author": "Ahmad Saleem",
      "avatar": "https://www.gravatar.com/avatar/38445f84fe28aa19bfeb1f59f6559532?d=identicon\u0026s=64",
      "cl": "316315@main",
      "clUrl": "https://commits.webkit.org/316315@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318301\nrdar://181098694\n\nReviewed by Simon Fraser.\n\nRemove three declarations that have no definition and no callers.\n\n* html/track/VTTCue.h:\n- Remove unused m_cue member; VTTCueBox forwards its cue to the base\nTextTrackCueBox and reads it back via getCue().\n- Remove undefined parseSettings() declaration.\n* html/track/LoadableTextTrack.h:\nRemove undefined loadTimerFired() declaration.\n\nCanonical link: https://commits.webkit.org/316315@main",
      "email": "ahmad.saleem792+github@gmail.com",
      "hash": "aa79ccb1924d85deca0eb18de06d1cf3adba4c0f",
      "subject": "Remove dead declarations from VTTCue and LoadableTextTrack headers"
    },
    "316316@main": {
      "author": "Tyler Wilcock",
      "avatar": "https://www.gravatar.com/avatar/9545082e6bed96158a9f52dac6e4b869?d=identicon\u0026s=64",
      "cl": "316316@main",
      "clUrl": "https://commits.webkit.org/316316@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317597\nrdar://180319221\n\nReviewed by Dominic Mazzoni.\n\nWhen an element references another via aria-labelledby, its accessible name\nwas not recomputed if the referenced element's name changed via aria-label\n(or alt/title) — only text-content changes propagated. In the isolated tree\nthis left a stale cached name.\n\nAXObjectCache::handleTextChanged walks the changed object's ancestors and\nnotifies the objects each one labels (labelForObjects()) so their names get\nrecomputed. That propagation was gated behind `if (isText)`, but aria-label,\nalt, and title changes reach handleTextChanged with a non-static-text object,\nso the labelledby referrer was never notified.\n\nHoist the labelForObjects() propagation out of the isText block so it runs for\nevery text/name change.\n\n* LayoutTests/accessibility/aria-labelledby-updates-when-aria-label-changes-expected.txt: Added.\n* LayoutTests/accessibility/aria-labelledby-updates-when-aria-label-changes.html: Added.\n* Source/WebCore/accessibility/AXObjectCache.cpp:\n(WebCore::AXObjectCache::handleTextChanged):\n\nCanonical link: https://commits.webkit.org/316316@main",
      "email": "tyler_w@apple.com",
      "hash": "66ebec86604f2eba2d21cc106d1ea7999faf06fb",
      "subject": "AX: VoiceOver does not re-resolve aria-labelledby when referenced element's    accessible name is provided by aria-label"
    },
    "316317@main": {
      "author": "Alex Christensen",
      "avatar": "https://www.gravatar.com/avatar/b087c5dfcb1233e80cad9105fd5a1ac6?d=identicon\u0026s=64",
      "cl": "316317@main",
      "clUrl": "https://commits.webkit.org/316317@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318368\nrdar://181049251\n\nUnreviewed.\n\nThis re-merges 316224@main which was reverted in 316230@main.\nThere were no issues, just a temporary internal build failure.\n\nTests: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/JSBuffer.mm\n       Tools/TestWebKitAPI/Tests/WebKit/WKWebView/UserContentController.mm\n\n* Source/WebKit/Modules/OSX_Private.modulemap:\n* Source/WebKit/Modules/iOS_Private.modulemap:\n* Source/WebKit/PlatformIOS.cmake:\n* Source/WebKit/Shared/API/APIObject.h:\n* Source/WebKit/Shared/API/Cocoa/WebKit.h:\n* Source/WebKit/Shared/Cocoa/APIObject.mm:\n(API::Object::newObject):\n* Source/WebKit/Shared/WebUserContentControllerDataTypes.cpp:\n(WebKit::WebJSBufferData::WebJSBufferData):\n* Source/WebKit/Shared/WebUserContentControllerDataTypes.h:\n* Source/WebKit/Sources.txt:\n* Source/WebKit/SourcesCocoa.txt:\n* Source/WebKit/UIProcess/API/APIJSBuffer.cpp: Removed.\n* Source/WebKit/UIProcess/API/APIJSBuffer.h: Removed.\n* Source/WebKit/UIProcess/API/Cocoa/WKJSScriptingBuffer.h: Removed.\n* Source/WebKit/UIProcess/API/Cocoa/WKJSScriptingBuffer.mm: Removed.\n* Source/WebKit/UIProcess/API/Cocoa/WKJSScriptingBufferInternal.h: Removed.\n* Source/WebKit/UIProcess/API/Cocoa/WKUserContentController.h:\n* Source/WebKit/UIProcess/API/Cocoa/WKUserContentController.mm:\n(-[WKUserContentController addBuffer:name:contentWorld:]):\n(-[WKUserContentController _addBuffer:contentWorld:name:]): Deleted.\n(-[WKUserContentController _removeBufferWithName:contentWorld:]): Deleted.\n* Source/WebKit/UIProcess/API/Cocoa/WKUserContentControllerPrivate.h:\n* Source/WebKit/UIProcess/API/Cocoa/_WKJSBuffer.h: Removed.\n* Source/WebKit/UIProcess/UserContent/WebUserContentControllerProxy.cpp:\n(WebKit::WebUserContentControllerProxy::parametersForProcess const):\n(WebKit::WebUserContentControllerProxy::addJSBuffer):\n* Source/WebKit/UIProcess/UserContent/WebUserContentControllerProxy.h:\n* Source/WebKit/WebKit.xcodeproj/project.pbxproj:\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/JSBuffer.mm:\n(TEST(JSBuffer, Data)):\n(TEST(JSBuffer, EvaluateScript)):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/UserContentController.mm:\n(TEST(WKUserContentController, JSBufferInjectsWebKitNamespace)):\n\nCanonical link: https://commits.webkit.org/316317@main",
      "email": "achristensen@apple.com",
      "hash": "98d170109035f7fbc581cbdf5fb038c64451561a",
      "subject": "Remove WKJSScriptingBuffer"
    },
    "316318@main": {
      "author": "Jessica Lee",
      "avatar": "https://www.gravatar.com/avatar/fc717c99321d09f31fb9187418a8ffc5?d=identicon\u0026s=64",
      "cl": "316318@main",
      "clUrl": "https://commits.webkit.org/316318@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318308\nrdar://181101048\n\nReviewed by Per Arne Vollan.\n\nThis function is unused and can be removed.\n\nNo new tests needed.\n\n* Source/WebCore/loader/DocumentLoader.cpp:\n(WebCore::DocumentLoader::scheduleCannotShowURLError): Deleted.\n* Source/WebCore/loader/DocumentLoader.h:\n\nCanonical link: https://commits.webkit.org/316318@main",
      "email": "jlee53@apple.com",
      "hash": "d3920704e8bd7885a07987f2495a8e63de918240",
      "subject": "DocumentLoader::scheduleCannotShowURLError is unused"
    },
    "316319@main": {
      "author": "Mark Lam",
      "avatar": "https://www.gravatar.com/avatar/87a4219a10aeda88757492c63da746de?d=identicon\u0026s=64",
      "cl": "316319@main",
      "clUrl": "https://commits.webkit.org/316319@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312525\nrdar://174626446\n\nReviewed by Yijia Huang.\n\nWhen an Extension ExpressionInfo is emitted, it needs to encode a displacement offset from\nits location to the location of its extension island.  For a MultiWide ExpressionInfo,\nparts of its island has already been emitted (from copying the MultiWide record over).  As\na result, the size of m_expressionInfoEncodedInfo is no longer the same as the starting\noffset of extension island.  As a result, the offset encoded in the Extension ExpressionInfo\nwill be incorrect.\n\nThe fix is simply to cache the location of the extension island before we start copying the\nMultiWide ExpressionInfo over.  We will use this cached location to emit the Extension\nExpressionInfo instead of using m_expressionInfoEncodedInfo.size() as we do for other cases.\n\nAlso fixed some typos and errors in comments.\n\nAlso fixed the decoding of DuoWide field2 in ExpressionInfo::dumpEncodedInfo().  This is\nonly used for debugging code.\n\nTest: JSTests/stress/expression-info-multi-wide-encoding.js\n\n* JSTests/stress/expression-info-multi-wide-encoding.js: Added.\n(catch):\n* Source/JavaScriptCore/bytecode/ExpressionInfo.cpp:\n(JSC::ExpressionInfo::Encoder::adjustInstPC):\n(JSC::ExpressionInfo::dumpEncodedInfo):\n\nOriginally-landed-as: 305413.693@safari-7624-branch (e321c398762a). rdar://181074668\nCanonical link: https://commits.webkit.org/316319@main",
      "email": "mark.lam@apple.com",
      "hash": "449c42b27f306b9b4906702b33d9f731dd558055",
      "subject": "ExpressionInfo::Encoder computes the offset to Extension Islands incorrectly."
    },
    "316320@main": {
      "author": "Megan Gardner",
      "avatar": "https://www.gravatar.com/avatar/b466a5bcbfabf4d82a8ecc595db5a531?d=identicon\u0026s=64",
      "cl": "316320@main",
      "clUrl": "https://commits.webkit.org/316320@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=317253\nrdar://175304947\n\nReviewed by Abrar Rahman Protyasha.\n\nOn sites whose rich-text editor maintains its own document model and reconciles the DOM after every WebKit-driven\nmutation (Lexical on Reddit, ProseMirror, Slate, CKEditor 5), suggestion marker offsets cached in\nWritingToolsController go stale across state-update events, and subsequent Pending/Accepted writes land at the wrong\nlocation. Validate the marker's current target text against the expected text on each update; if the offsets have\ndrifted, re-anchor by searching the session range for the expected text and picking the closest match. Bail out\ncleanly if it can't be found rather than writing into a stale range. Also remove suggestion markers by suggestion ID\nacross the whole session range instead of by cached node + offset, since the cached node can itself be stale after a\nreconcile.\n\nTest: Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WritingTools.mm\n\n* Source/WebCore/page/writing-tools/WritingToolsController.h:\n* Source/WebCore/page/writing-tools/WritingToolsController.mm:\n(WebCore::WritingToolsController::proofreadingSessionDidUpdateStateForSuggestion):\n(WebCore::WritingToolsController::validatedRangeForSuggestionMarker const):\n* Tools/TestWebKitAPI/Tests/WebKit/WKWebView/WritingTools.mm:\n(TEST(WritingTools, ProofreadingReviewDoesNotWriteIntoDriftedMarker)):\n\nCanonical link: https://commits.webkit.org/316320@main",
      "email": "megan_gardner@apple.com",
      "hash": "d7c42ec32b31f263bccc11a2625e30d60ea54c29",
      "subject": "[Writing Tools] Hovering over the different options for AOP causes both suggestions to get inserted."
    },
    "316321@main": {
      "author": "Sammy Gill",
      "avatar": "https://www.gravatar.com/avatar/715a3cfee5d85ee90ccfdaa2a4a7a5a3?d=identicon\u0026s=64",
      "cl": "316321@main",
      "clUrl": "https://commits.webkit.org/316321@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318354\nrdar://problem/181142446\n\nReviewed by Vitor Roriz.\n\nThe track sizing algorithm built a parallel list of every grid item's\nopposite-axis constraint (by mapping the field off each TrackSizingItem) and\nthreaded it through the min-content / max-content / used-minimum-size helpers.\nThat constraint already lives on TrackSizingItem, which those helpers already\nhave, so read it from there directly and drop the redundant list, its builder\n(oppositeAxisConstraintList), the ResolveIntrinsicTrackSizesContext member, and\nthe now-unused TrackSizingGridItemConstraintList alias.\n\nAlso rename the usedMinimumSize callback's opposite-axis parameter so that it is\nclear what the \"opposite axis,\" is. For example, the opposite axis\nconstraint for the inline axis sizing functions is the block axis\nconstraints.\n\nCanonical link: https://commits.webkit.org/316321@main",
      "email": "sammy.gill@apple.com",
      "hash": "85af8f729098c4194644529c26b692d6e2cf72ae",
      "subject": "[GFC][Cleanup] Remove redundant opposite axis constraints list"
    },
    "316322@main": {
      "author": "Chris Dumez",
      "avatar": "https://www.gravatar.com/avatar/a9f21fe3a8baf79b45f3c91572187bdc?d=identicon\u0026s=64",
      "cl": "316322@main",
      "clUrl": "https://commits.webkit.org/316322@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=315006\nrdar://176816153\n\nReviewed by Ryosuke Niwa.\n\nHarden WebFrameProxy::getFrameInfo() so the security-relevant fields of\nthe FrameInfoData struct returned by WebProcess are now validated.\nIn case of mismatch, we overwrite with correct values and log an error\nmessage instead of doing a MESSAGE_CHECK, to reduce risk.\n\n* Source/WebKit/UIProcess/WebFrameProxy.cpp:\n(WebKit::WebFrameProxy::getFrameInfo):\n\nOriginally-landed-as: 305413.931@safari-7624-branch (332b0cbb0bb4). rdar://180428935\nCanonical link: https://commits.webkit.org/316322@main",
      "email": "cdumez@apple.com",
      "hash": "c344219c444e74eaafed53f1fab580fdb8e71a45",
      "subject": "Missing validation of frameInfo in WebFrameProxy::getFrameInfo()"
    },
    "316324@main": {
      "author": "Youenn Fablet",
      "avatar": "https://www.gravatar.com/avatar/0a9886e582a7aee1eb908eb59af36da4?d=identicon\u0026s=64",
      "cl": "316324@main",
      "clUrl": "https://commits.webkit.org/316324@main",
      "description": "rdar://180939670\nhttps://bugs.webkit.org/show_bug.cgi?id=318303\n\nReviewed by Jonathan Bedard.\n\nWe update the test to allow the possibility of an encoder with a low H264 profile to drop a frame that is too big for the profile.\nThis happens in recent macOS versions.\n\n* LayoutTests/http/wpt/webcodecs/encoder-task-failing.html:\n\nCanonical link: https://commits.webkit.org/316324@main",
      "email": "youenn@apple.com",
      "hash": "c0d0af2b0f8e17bd48cd6d6b181f1467b75a110e",
      "subject": "http/wpt/webcodecs/encoder-task-failing.html should account for encoder dropping the video frame"
    },
    "316325@main": {
      "author": "Carlos Alberto Lopez Perez",
      "avatar": "https://www.gravatar.com/avatar/05326c1dbe06f486e884975e73f25179?d=identicon\u0026s=64",
      "cl": "316325@main",
      "clUrl": "https://commits.webkit.org/316325@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318364\n\nReviewed by Ryan Haddad.\n\nLately the queue WPE-Build-EWS is taking longer to process the builds and those accumulate.\nAdding 3 more workers will relieve preassure. This queue was 1 bot shorter than the GTK-Build\none, but now it will have 2 workers more (5 vs 7).\n\n* Tools/CISupport/ews-build/config.json:\n\nCanonical link: https://commits.webkit.org/316325@main",
      "email": "clopez@igalia.com",
      "hash": "fabc963bd4b2202dc3f0df9635ceae1c2f53c50e",
      "subject": "[WKCI][ews-build.webkit.org][WPE] Add 3 more workers to the queue WPE-Build-EWS"
    },
    "316326@main": {
      "author": "Said Abou-Hallawa",
      "avatar": "https://www.gravatar.com/avatar/ae80a929a378a055822829ae63903296?d=identicon\u0026s=64",
      "cl": "316326@main",
      "clUrl": "https://commits.webkit.org/316326@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=312835\nrdar://174740190\n\nReviewed by Simon Fraser.\n\nCurrently these functions debug ASSERT only. In the release build, getPixelBuffer()\nreturns without filling the PixelBuffer with zeros. If the ImageBuffer is remote,\nthe returned PixelBuffer will be serialized uninitialized to the WebProcess.\n\nRemoteImageBuffer should MESSAGE_CHECK, the backend has pixels. The calls to\nputPixelBuffer() and getPixelBuffer() should not be made in normal snapshotting\nscenarios.\n\n* Source/WebCore/platform/graphics/ImageBufferDisplayListBackend.h:\n* Source/WebCore/platform/graphics/cg/ImageBufferCGPDFDocumentBackend.h:\n* Source/WebKit/GPUProcess/graphics/RemoteImageBuffer.cpp:\n(WebKit::RemoteImageBuffer::getPixelBuffer):\n(WebKit::RemoteImageBuffer::putPixelBuffer):\n\nOriginally-landed-as: 305413.751@safari-7624-branch (acb3c0834c1a). rdar://180436488\nCanonical link: https://commits.webkit.org/316326@main",
      "email": "said@apple.com",
      "hash": "6a20a3d21098d9e1fcf0bfbcb5f6133847781a77",
      "subject": "putPixelBuffer() and getPixelBuffer() should never be called for PDF and DisplayList ImageBufferBackends"
    },
    "316327@main": {
      "author": "Yusuke Suzuki",
      "avatar": "https://www.gravatar.com/avatar/3455d9081295e3e740c1ffa901217d9b?d=identicon\u0026s=64",
      "cl": "316327@main",
      "clUrl": "https://commits.webkit.org/316327@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318297\nrdar://181088818\n\nReviewed by Keith Miller and Dan Hecht.\n\nIn GC marking, the highest cost comes from marking a large graph, and it\nis bound by a cache miss for each GC-managed cell.\n\nThis patch adds manual pipelining of cell prefetching. We keep the one\nnext cell pointer and issuing a prefetch while handling the current cell\nso that prefetch can be in flight while handling the current cell,\nreducing a stale by pipelining the memory access.\n\n* Source/JavaScriptCore/heap/SlotVisitor.cpp:\n(JSC::SlotVisitor::drain):\n\nCanonical link: https://commits.webkit.org/316327@main",
      "email": "ysuzuki@apple.com",
      "hash": "5ecce0f050d283d922a3a68100c1a583edb432be",
      "subject": "[JSC] Manually pipeline memory fetching for GC marking"
    },
    "316328@main": {
      "author": "Jessica Lee",
      "avatar": "https://www.gravatar.com/avatar/fc717c99321d09f31fb9187418a8ffc5?d=identicon\u0026s=64",
      "cl": "316328@main",
      "clUrl": "https://commits.webkit.org/316328@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318310\nrdar://181102705\n\nReviewed by Per Arne Vollan.\n\nWe should initialize m_fromDownloadAttribute to a default value of WebCore::FromDownloadAttribute::No.\n\nNo new tests needed.\n\n* Source/WebKit/NetworkProcess/Downloads/PendingDownload.h:\n\nCanonical link: https://commits.webkit.org/316328@main",
      "email": "jlee53@apple.com",
      "hash": "81028a04183a636b89d6b4d7d138d59552bf0ed4",
      "subject": "Provide default value to PendingDownload 's m_fromDownloadAttribute"
    },
    "316329@main": {
      "author": "Marcus Plutowski",
      "avatar": "https://www.gravatar.com/avatar/0dc4fa1c337348e333de44505752edb8?d=identicon\u0026s=64",
      "cl": "316329@main",
      "clUrl": "https://commits.webkit.org/316329@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=311600\nrdar://173772317\n\nReviewed by Yusuke Suzuki.\n\nIn the case that the allocation record table is controlled by an\nattacker, we cannot trust the offsets contained inside, and should\nassert that we do not read out-of-bounds based on them.\n\nOriginally-landed-as: 305413.727@safari-7624-branch (729d412ab091). rdar://180429014\nCanonical link: https://commits.webkit.org/316329@main",
      "email": "marcus_plutowski@apple.com",
      "hash": "6cccd5ef64eea5636933ece6f19de4571396828c",
      "subject": "[libpas] Fix OoBable code-paths in MAR code"
    },
    "316330@main": {
      "author": "Alan Baradlay",
      "avatar": "https://www.gravatar.com/avatar/788d66417db806c567552cfa1ae89f77?d=identicon\u0026s=64",
      "cl": "316330@main",
      "clUrl": "https://commits.webkit.org/316330@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318067\n\nReviewed by Antti Koivisto.\n\nA few members lived on the wrong class; move them to where they belong.\n\ncontentChanged(), hasAcceleratedCompositing() and the ContentChangeType enum only\ntouch the renderer's layer and the compositor, so they move from RenderBoxModelObject\nup to RenderLayerModelObject, the class that owns the layer.\n\nbackgroundIsKnownToBeOpaqueInRect() is only meaningful for RenderBox, so it moves from\na RenderLayerModelObject virtual down to a RenderBox virtual; RenderLayer reaches it\nthrough renderBox().\n\ncanHaveBoxInfoInFragment() is only used in assertions, so it becomes a debug-only free\nfunction in RenderBox.cpp.\n\nNo behavior change.\n\n* Source/WebCore/rendering/RenderBox.cpp:\n(WebCore::canHaveBoxInfoInFragment):\n(WebCore::RenderBox::computeOutOfFlowPositionedLogicalWidth const):\n(WebCore::RenderBox::computeOutOfFlowPositionedLogicalHeight const):\n* Source/WebCore/rendering/RenderBox.h:\n* Source/WebCore/rendering/RenderBoxModelObject.cpp:\n(WebCore::RenderBoxModelObject::contentChanged): Deleted.\n(WebCore::RenderBoxModelObject::hasAcceleratedCompositing const): Deleted.\n* Source/WebCore/rendering/RenderBoxModelObject.h:\n(WebCore::RenderBoxModelObject::canHaveBoxInfoInFragment const): Deleted.\n* Source/WebCore/rendering/RenderLayer.cpp:\n(WebCore::RenderLayer::calculateClipRects const):\n* Source/WebCore/rendering/RenderLayerModelObject.cpp:\n(WebCore::RenderLayerModelObject::contentChanged):\n(WebCore::RenderLayerModelObject::hasAcceleratedCompositing const):\n* Source/WebCore/rendering/RenderLayerModelObject.h:\n(WebCore::RenderLayerModelObject::backgroundIsKnownToBeOpaqueInRect const): Deleted.\n\nCanonical link: https://commits.webkit.org/316330@main",
      "email": "zalan@apple.com",
      "hash": "221b4649ae211df8f9da8b219fed14bebc620b4b",
      "subject": "[cleanup] Move members to the appropriate class among RenderBoxModelObject, RenderLayerModelObject and RenderBox"
    },
    "316331@main": {
      "author": "Marta Darbinyan",
      "avatar": "https://www.gravatar.com/avatar/6143b3673258642a8b75585c768ccf10?d=identicon\u0026s=64",
      "cl": "316331@main",
      "clUrl": "https://commits.webkit.org/316331@main",
      "description": "https://bugs.webkit.org/show_bug.cgi?id=318375\nrdar://181164450\n\nUnreviewed test gardening\n\n* LayoutTests/platform/ios/TestExpectations:\n\nCanonical link: https://commits.webkit.org/316331@main",
      "email": "darbinyan@apple.com",
      "hash": "6aa3e922523e6b3a99d372f53fed7202d9db9c2e",
      "subject": "[Gardening]: [iOS] imported/w3c/web-platform-tests/css/css-anchor-position/scroll-to-anchored-fixed-001.html is flaky in image diff"
    }
  },
  "date": "2026-07-01",
  "days": 1,
  "generatedAt": "2026-07-01T22:08:05Z",
  "markdown": "## Highlights\n\n- **Security** WebKit spent the day burning down memory safety bugs across navigation, blobs, clipboard, extensions, XR, and GPU-adjacent code paths, closing a broad set of UAF and OOB issues. [commit 316299@main](https://commits.webkit.org/316299@main)\n- **V8** JSC landed a real runtime win by pipelining memory fetches during GC marking, alongside more FTL coverage for common string ops. [commit 316327@main](https://commits.webkit.org/316327@main)\n- **Web Platform** CSS mixins and anchor positioning kept moving forward with parser and scoping fixes that tighten spec behavior instead of papering over it. [commit 316257@main](https://commits.webkit.org/316257@main)\n- **Rendering** Grid and animation work fixed real layout and crash bugs, including min-size handling and accelerated timeline edge cases. [commit 316284@main](https://commits.webkit.org/316284@main)\n- **Media** Media got a dense batch of correctness fixes across WebCodecs, WebRTC, HLS captions, MediaStream events, and audio session activation. [commit 316301@main](https://commits.webkit.org/316301@main)\n- **DevTools** Inspector fixed duplicate window-object notifications, symbolic breakpoints on native constructors, and a canvas-agent crash. [commit 316262@main](https://commits.webkit.org/316262@main)\n- **A11y** Accessibility work improved VoiceOver name recomputation and pulled video captions into Find in Page on macOS. [commit 316316@main](https://commits.webkit.org/316316@main)\n- **UI** Apple-platform polish landed for Writing Tools, gesture selection, visionOS captions, and pointer lock regressions on iOS. [commit 316320@main](https://commits.webkit.org/316320@main)\n- **Build** There was also a lot of tree health work: WPE capacity added, multiple build regressions fixed, and platform build support tightened. [commit 316325@main](https://commits.webkit.org/316325@main)\n\n## What landed by area\n\n### Security and process model\n\n- **Security** Added missing validation in `WebFrameProxy::getFrameInfo()`, closing a bad frame-info path. [commit 316322@main](https://commits.webkit.org/316322@main)\n- **Security** Fixed a use-after-free in `WebPageProxy::sendToWebPage` from off-main-thread MarketplaceKit completion handling. [commit 316299@main](https://commits.webkit.org/316299@main)\n- **Security** Fixed heap use-after-free in `WebExtensionRegisteredScriptsSQLiteStore::addScripts`. [commit 316283@main](https://commits.webkit.org/316283@main)\n- **Security** Fixed concurrent-queue use-after-free in declarative net request resource targeting. [commit 316281@main](https://commits.webkit.org/316281@main)\n- **Security** Fixed heap use-after-free in `ClipboardItemBindingsDataSource::clearItemTypeLoaders()`. [commit 316278@main](https://commits.webkit.org/316278@main)\n- **Security** Fixed use-after-free of `Document` in `trustedTypeCompliantString`. [commit 316274@main](https://commits.webkit.org/316274@main)\n- **Security** Fixed re-entrant history traversal use-after-free in `HistoryController::recursiveGoToItem`. [commit 316272@main](https://commits.webkit.org/316272@main)\n- **Security** Local file loads are now always checked in `NetworkResourceLoader::startNetworkLoad`. [commit 316268@main](https://commits.webkit.org/316268@main)\n- **Security** Fixed a race in `UserMediaCaptureManagerProxy` that could lead to UAF and write-after-unmap. [commit 316261@main](https://commits.webkit.org/316261@main)\n- **Security** Fixed cross-thread UAF write in `AsyncFileStream::read` via `NetworkDataTaskBlob`. [commit 316253@main](https://commits.webkit.org/316253@main)\n- **Security** The Network process no longer creates form data sandbox extensions. [commit 316251@main](https://commits.webkit.org/316251@main)\n- **Security** Fixed cross-origin parent DOM exposure via `NavigateEvent.sourceElement`. [commit 316245@main](https://commits.webkit.org/316245@main)\n- **Security** Fixed use-after-free in `XRSessionInit` dictionary conversion via `sequence\u003cany\u003e`. [commit 316227@main](https://commits.webkit.org/316227@main)\n- **Security** Fixed use-after-free on `SecurityOrigin` in `NavigationScheduler::scheduleLocationChange`. [commit 316217@main](https://commits.webkit.org/316217@main)\n- **Security** Fixed cross-thread destruction of `BlobData` that raced non-thread-safe refcounting and could UAF. [commit 316216@main](https://commits.webkit.org/316216@main)\n- **Security** Tightened pasteboard read gating and case handling in process-model code. [commit 316215@main](https://commits.webkit.org/316215@main)\n- **Security** Removed dead FTP directory listing support, shrinking legacy surface area. [commit 316212@main](https://commits.webkit.org/316212@main)\n- **Security** Fixed WebXR session teardown UAF when the owning `WebXRSystem` had already been GC'd. [commit 316209@main](https://commits.webkit.org/316209@main)\n\n### JavaScriptCore and WebAssembly\n\n- **Perf** JSC now manually pipelines memory fetching for GC marking. [commit 316327@main](https://commits.webkit.org/316327@main)\n- **Security** Fixed incorrect offset computation to Extension Islands in `ExpressionInfo::Encoder`. [commit 316319@main](https://commits.webkit.org/316319@main)\n- **Refactor** JSC removed `Air::lowerMacros`. [commit 316308@main](https://commits.webkit.org/316308@main)\n- **Perf** JSC inlined `StringSlice` rope construction in FTL. [commit 316307@main](https://commits.webkit.org/316307@main)\n- **Security** `IPInt` now uses `std::optional` for `m_pendingOffset` with overflow assertions on metadata offsets. [commit 316298@main](https://commits.webkit.org/316298@main)\n- **Refactor** JSC overrode `isValid()` on `AdaptiveValuePropertyInlineCacheClearingWatchpoint`. [commit 316292@main](https://commits.webkit.org/316292@main)\n- **Security** WasmGC now rejects reserved bits in `br_on_cast` and `br_on_cast_fail` flags. [commit 316266@main](https://commits.webkit.org/316266@main)\n- **Security** The streaming compiler now rejects mixed legacy and spec-correct exception handling. [commit 316259@main](https://commits.webkit.org/316259@main)\n- **Security** Memory64 import linking now checks for memory address type mismatches. [commit 316258@main](https://commits.webkit.org/316258@main)\n- **Perf** JSC added DFG and FTL handling for `String#trim`, `trimStart`, and `trimEnd`. [commit 316254@main](https://commits.webkit.org/316254@main)\n- **Web Platform** Fixed a test262 failure around TypedArray constructor error ordering and custom prototype access. [commit 316237@main](https://commits.webkit.org/316237@main)\n- **Build** JSC skipped failing wasm SIMD modes on Linux arm64 to keep bots green while the underlying issue is sorted. [commit 316225@main](https://commits.webkit.org/316225@main)\n- **Refactor** Removed old JetStream3 files. [commit 316214@main](https://commits.webkit.org/316214@main)\n\n### Rendering, layout, and CSS\n\n- **Refactor** RenderBox and related classes were cleaned up by moving members to the right abstraction layers. [commit 316330@main](https://commits.webkit.org/316330@main)\n- **Refactor** GFC removed a redundant opposite-axis constraints list. [commit 316321@main](https://commits.webkit.org/316321@main)\n- **Rendering** Grid item stretch preferred sizing now computes min-content contributions correctly. [commit 316296@main](https://commits.webkit.org/316296@main)\n- **Rendering** Added `FloatQuad::intersectsQuad` for quad intersection testing. [commit 316291@main](https://commits.webkit.org/316291@main)\n- **Refactor** RenderBox `frameRect()` naming was clarified to `borderBoxRectInContainer()`. [commit 316286@main](https://commits.webkit.org/316286@main)\n- **Rendering** GFC fixed cases where min sizes were not respected. [commit 316284@main](https://commits.webkit.org/316284@main)\n- **Web Platform** CSS variable fallback now resolves only when the first argument resolves invalid. [commit 316280@main](https://commits.webkit.org/316280@main)\n- **Rendering** Fixed an off-by-one regression in `FEMorphology` filter height. [commit 316267@main](https://commits.webkit.org/316267@main)\n- **Web Platform** CSS mixins now unwrap braces in function arguments correctly. [commit 316265@main](https://commits.webkit.org/316265@main)\n- **Web Platform** CSS mixin `@function` names now resolve in the scope where the function was defined. [commit 316257@main](https://commits.webkit.org/316257@main)\n- **Refactor** RenderBox dropped its DOM-flavored `client*` API. [commit 316255@main](https://commits.webkit.org/316255@main)\n- **Rendering** Fixed BFCache restore assertion with cross-site iframes under site isolation. [commit 316243@main](https://commits.webkit.org/316243@main)\n- **Rendering** Event regions are back for non-layer SVG children after an LBSE regression. [commit 316229@main](https://commits.webkit.org/316229@main)\n- **Web Platform** Fixed anchor-position adjuster mutation while iterating scrollers. [commit 316226@main](https://commits.webkit.org/316226@main)\n- **Refactor** GFC moved `GridItemSizingFunctions` into its own file. [commit 316222@main](https://commits.webkit.org/316222@main)\n- **Rendering** `MathOperator::reset()` now correctly reinitializes its glyph or assembly union. [commit 316219@main](https://commits.webkit.org/316219@main)\n- **Refactor** `RenderElement` consolidated bitfields and moved initializers into the header. [commit 316206@main](https://commits.webkit.org/316206@main)\n\n### Media, WebRTC, WebCodecs, and animations\n\n- **Media** `putPixelBuffer()` and `getPixelBuffer()` are now blocked for PDF and DisplayList image buffer backends. [commit 316326@main](https://commits.webkit.org/316326@main)\n- **Media** WebCodecs WPT was updated to account for encoders dropping a video frame. [commit 316324@main](https://commits.webkit.org/316324@main)\n- **Media** Safari HLS generated transcriptions now line-break correctly. [commit 316311@main](https://commits.webkit.org/316311@main)\n- **Media** AudioSession activation is now asynchronous under site isolation. [commit 316303@main](https://commits.webkit.org/316303@main)\n- **Web Platform** `configurationchange` is no longer dropped when a muted MediaStream track changes configuration. [commit 316301@main](https://commits.webkit.org/316301@main)\n- **Rendering** Fixed a crash with accelerated animations using view progress timeline ranges and scroll time. [commit 316300@main](https://commits.webkit.org/316300@main)\n- **Rendering** Animation current time now matches the element's animation when autoplay is on. [commit 316305@main](https://commits.webkit.org/316305@main)\n- **A11y** macOS Find in Page now includes video caption cues. [commit 316289@main](https://commits.webkit.org/316289@main)\n- **Rendering** Threaded time-based animations were enabled on CNN.com on iOS. [commit 316288@main](https://commits.webkit.org/316288@main)\n- **Media** Fixed swapped SRTP auth-key ternary branches in `RTCPacketOptions::serializableData`. [commit 316287@main](https://commits.webkit.org/316287@main)\n- **Media** iOS networking no longer gets pinned in a MediaStreaming state when WebContent is suspended mid-stream. [commit 316279@main](https://commits.webkit.org/316279@main)\n- **Media** `PlatformTimeRanges::span` replaced manual `start(index)` and `end(index)` access. [commit 316252@main](https://commits.webkit.org/316252@main)\n- **Rendering** Fixed a crash when creating accelerated representations for animations tied to an external document timeline. [commit 316250@main](https://commits.webkit.org/316250@main)\n- **UI** visionOS YouTube captions no longer briefly duplicate when docking into the system environment. [commit 316238@main](https://commits.webkit.org/316238@main)\n- **Refactor** Removed dead declarations from `VTTCue` and `LoadableTextTrack` headers. [commit 316315@main](https://commits.webkit.org/316315@main)\n- **Refactor** Corrected a misnamed local static in `WebVTTElement::langAttributeName()`. [commit 316239@main](https://commits.webkit.org/316239@main)\n- **Rendering** The duplicate accelerated-animation crash fix also landed as a second import/update commit. [commit 316210@main](https://commits.webkit.org/316210@main)\n\n### Networking, navigation, and loading\n\n- **Refactor** `PendingDownload::m_fromDownloadAttribute` now has a default value. [commit 316328@main](https://commits.webkit.org/316328@main)\n- **Refactor** Removed unused `DocumentLoader::scheduleCannotShowURLError`. [commit 316318@main](https://commits.webkit.org/316318@main)\n- **Security** Preloaded module scripts now work correctly under strict-dynamic CSP instead of being blocked. [commit 316290@main](https://commits.webkit.org/316290@main)\n- **Privacy** `_setAllowOnlyPartitionedCookies` is now correctly applied to WebSocket requests on Cocoa. [commit 316273@main](https://commits.webkit.org/316273@main)\n- **Refactor** Replaced `isInitialAboutBlank` bool with an enum class. [commit 316263@main](https://commits.webkit.org/316263@main)\n- **Refactor** Improved log efficiency in `FrameLoader::clearProvisionalLoad`. [commit 316235@main](https://commits.webkit.org/316235@main)\n- **Refactor** Improved log efficiency in `CoreIPCNSURLRequest`. [commit 316234@main](https://commits.webkit.org/316234@main)\n- **Refactor** Removed `treatAsSameOriginNavigation` from `NavigationActionData` IPC. [commit 316244@main](https://commits.webkit.org/316244@main)\n\n### GPU, WebGL, and graphics\n\n- **Security** libpas fixed out-of-bounds-capable MAR code paths. [commit 316329@main](https://commits.webkit.org/316329@main)\n- **Security** Fixed uint32 wraparound in `vsUintIndexClamp` that could lead to GPU out-of-bounds reads. [commit 316276@main](https://commits.webkit.org/316276@main)\n- **Security** `bmalloc_try_allocate_zeroed_inline` now tracks zeroing correctly on the MAR branch instead of returning unzeroed memory. [commit 316277@main](https://commits.webkit.org/316277@main)\n- **Security** libpas fixed a race in `pas_segregated_heap_medium_size_directory_for_index`. [commit 316275@main](https://commits.webkit.org/316275@main)\n- **Security** Fixed `m_bufferMapCount` state confusion via `getMappedRange` that could lead to GPU OOB access. [commit 316270@main](https://commits.webkit.org/316270@main)\n- **GPU** Cleared stale `imageDef` in `TextureMtl::redefineImage` fast path. [commit 316260@main](https://commits.webkit.org/316260@main)\n- **Security** ANGLE `ResumeTransformFeedback` now validates the active program. [commit 316249@main](https://commits.webkit.org/316249@main)\n- **GPU** ANGLE fixed `EnsureLoopForwardProgress` misses in nested loop initializers and expressions. [commit 316248@main](https://commits.webkit.org/316248@main)\n- **Security** WebGL context restore now takes `objectGraphLock`, avoiding a GC race. [commit 316223@main](https://commits.webkit.org/316223@main)\n\n### Inspector, accessibility, editing, and Apple platform UI\n\n- **Refactor** Removed `WKJSScriptingBuffer` from Cocoa API surface. [commit 316317@main](https://commits.webkit.org/316317@main)\n- **A11y** VoiceOver now re-resolves `aria-labelledby` when the referenced element's accessible name comes from `aria-label`. [commit 316316@main](https://commits.webkit.org/316316@main)\n- **UI** Writing Tools no longer inserts both suggestions when hovering alternative options. [commit 316320@main](https://commits.webkit.org/316320@main)\n- **UI** MiniBrowser gained a setting to allow all TLS certificates for Cocoa testing and local debugging. [commit 316310@main](https://commits.webkit.org/316310@main)\n- **UI** AppKit word selection on double-click is fixed when scrolled to the top with obscured content insets. [commit 316304@main](https://commits.webkit.org/316304@main)\n- **DevTools** Web Inspector no longer dispatches `didClearWindowObject` twice for script-less frames. [commit 316294@main](https://commits.webkit.org/316294@main)\n- **DevTools** Symbolic breakpoints now work with native constructors. [commit 316262@main](https://commits.webkit.org/316262@main)\n- **UI** Writing Tools Siri affordance now stays positioned correctly after scrolling. [commit 316271@main](https://commits.webkit.org/316271@main)\n- **Editing** Building dictation alternatives no longer does an O(n) front shift. [commit 316242@main](https://commits.webkit.org/316242@main)\n- **Editing** `nextLineCandidatePosition` now respects the `editableType` parameter. [commit 316241@main](https://commits.webkit.org/316241@main)\n- **Mobile** iOS pointer lock no longer risks UAF when `RequestPointerLock` is fired twice in a row. [commit 316240@main](https://commits.webkit.org/316240@main)\n- **Editing** `ReplaceSelectionCommand` now strips `SVGStyleElement`. [commit 316236@main](https://commits.webkit.org/316236@main)\n- **Refactor** Reduced `HTMLAttachmentElement` size by 8 bytes via field reordering. [commit 316233@main](https://commits.webkit.org/316233@main)\n- **Refactor** Removed a dead null check in `ReplaceSelectionCommand::doApply`. [commit 316232@main](https://commits.webkit.org/316232@main)\n- **Refactor** Added a missing `break` in `ImageDataArray::tryCreate`. [commit 316231@main](https://commits.webkit.org/316231@main)\n- **Refactor** Reduced `PreloadRequest` size by 8 bytes via field reordering. [commit 316228@main](https://commits.webkit.org/316228@main)\n- **Refactor** Removed `WKJSScriptingBuffer` again in a follow-up landing path. [commit 316224@main](https://commits.webkit.org/316224@main)\n- **Refactor** Padding bits were fixed so `HTMLEntityTableEntry` gets the intended size optimization. [commit 316220@main](https://commits.webkit.org/316220@main)\n- **DevTools** Fixed a crash under `InspectorCanvasAgent::internalEnable`. [commit 316213@main](https://commits.webkit.org/316213@main)\n- **Refactor** `HTMLInputElement::setChecked()` no longer forces `invalidateStyle()`. [commit 316293@main](https://commits.webkit.org/316293@main)\n- **Refactor** Removed a stale misspelled forward declaration from `DataTransferItem.h`. [commit 316302@main](https://commits.webkit.org/316302@main)\n- **Refactor** `HTMLFrameElementBase::m_openingURLAfterInsertin` now uses `SetForScope`. [commit 316313@main](https://commits.webkit.org/316313@main)\n\n### Build, tests, and infrastructure\n\n- **Build** WPE Build EWS got 3 more workers. [commit 316325@main](https://commits.webkit.org/316325@main)\n- **Build** Fixed a follow-up build break after `249edf86a9f55`. [commit 316312@main](https://commits.webkit.org/316312@main)\n- **Build** Fixed a WPE regression caused by `316292@main`. [commit 316309@main](https://commits.webkit.org/316309@main)\n- **Build** WPE arm64 test gardening landed. [commit 316285@main](https://commits.webkit.org/316285@main)\n- **Build** GTK and WPE test gardening landed. [commit 316282@main](https://commits.webkit.org/316282@main)\n- **Build** Fixed CMake after `316251@main`. [commit 316269@main](https://commits.webkit.org/316269@main)\n- **Build** Fixed another `316251@main` regression involving `getHomeDirectory` declarations. [commit 316264@main](https://commits.webkit.org/316264@main)\n- **Build** `GeneratedSerializers` now includes soft link headers last. [commit 316247@main](https://commits.webkit.org/316247@main)\n- **Build** CMake media tests were fixed by restoring missing media control images. [commit 316246@main](https://commits.webkit.org/316246@main)\n- **Build** WPE now supports building with `POINTER_LOCK` enabled. [commit 316218@main](https://commits.webkit.org/316218@main)\n- **Build** Re-imported WPT resources. [commit 316211@main](https://commits.webkit.org/316211@main)\n- **Build** API test gardening fixes landed. [commit 316208@main](https://commits.webkit.org/316208@main)\n- **Build** The Apple Silicon O3 Debug JSC builder moved from Sequoia to Tahoe. [commit 316207@main](https://commits.webkit.org/316207@main)\n- **Build** Fixed a Cocoa API removal fallout that broke visionOS builds. [commit 316221@main](https://commits.webkit.org/316221@main)\n- **Build** Fixed an iOS build break introduced by `316168@main`. [commit 316205@main](https://commits.webkit.org/316205@main)\n- **Build** Marked a CSS anchor-position WPT flaky in image diff on iOS to stabilize bots. [commit 316331@main](https://commits.webkit.org/316331@main)\n- **Build** Marked 3 declarative net request API tests as constant timeouts during gardening. [commit 316306@main](https://commits.webkit.org/316306@main)\n\n## Reverts \u0026 Reapplies\n\n- **Build** No explicit Revert, Reapply, or Backed out commits appeared in this window.",
  "repo": "webkit",
  "repoDisplay": "WebKit",
  "rollGroups": [
    {
      "name": "Unreviewed",
      "count": 2
    },
    {
      "name": "Cherry-pick",
      "count": 2
    }
  ],
  "since": "2026-07-01",
  "totals": {
    "commits": 127,
    "features": 123,
    "rolls": 4
  },
  "until": "2026-07-01"
}